CVE-2026-33744

BentoML is affected by a Dockerfile command Injection via the docker.system_packages field in bentofile.yaml. The field’s values are interpolated directly into shell commands without sanitization, allowing a crafted package entry to execute arbitrary commands during bentoml containerize or docker...