day09-bentoml-deser-lab

Día 09 — CVE-2025-27520 deserialización insegura estilo BentoML — Laboratorio Docker local Este laboratorio reproduce la clase de deserialización insegura que condujo a CVE-2025-27520. Es intencionalmente vulnerable con fines educativos. Ejecútelo solo localmente en Docker. Inicio rápido Construy...

CVE-2025-27520-PoC

CVE-2025-27520 — Simulación educativa segura / PoC Demo Stand ⚠️ Importante: Esta es una simulación educativa y segura de la vulnerabilidad CVE-2025-27520. El proyecto incluye un servicio simulado Flask y un escáner PoC seguro Python. La simulación crea un archivo de evidencia en data/ al recibir...

Exploit for Deserialization of Untrusted Data in Bentoml

CVE-2025-27520 exploit for CVE-2025-27520 A Remote Code Execut...

📄 BentoML 1.4.2 Remote Code Execution

A remote code execution vulnerability caused by insecure deserialization has been identified in version 1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. This module requires Metasploit: https://metasploit.com/download Current source:...

BentoML Vulnerability Allows Remote Code Execution on AI Servers

TL;DR: A critical deserialization vulnerability CVSS 9.8 - CVE-2025-27520 in BentoML v1.3.8–1.4.2 lets attackers execute remote code without…...

CVE-2025-27520

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest version v1.4.2 of BentoML. It allows any unauthenticated user to execute...

CVE-2025-27520

BentoML 1.4.2 contains an insecure deserialization flaw in serde.py that enables unauthenticated RCE via crafted payloads. The issue, described across CVE-2025-27520 sources, is fixed in 1.4.3. Public PoCs and exploit modules exist (GitHub, Metasploit) illustrating remote command execution attemp...

CVE-2025-27520

creationtimestamp| type| source ---|---|--- 2025-04-04 00:59:47+00:00| published-proof-of-concept| https://github.com/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc 2025-04-04 15:15:09+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114280346981280788 2025-04-04 15:15:09+00:00|...