CVE-2026-112264

BentoML versions through 1.4.39 are vulnerable to a Dockerfile instruction injection vulnerability (CWE-78). The root cause is the lack of proper sanitization of docker.env mapping keys rendered by the legacy base.j2 template, which allows attackers to embed newlines into the configuration. By pr...