Database/AI/ML frameworks & serving
BentoML OpenLLM 0.6.30 (async_run_command in src/openllm/common.py): A model repository directory name flows unescaped
Impact
A model repository directory name flows unescaped into a shell command, so a crafted repository name executes attacker commands as the user running OpenLLM. The exploit is public and, as of the advisory, the project had not responded to the report.
Who can reach it
A local user of OpenLLM who adds or uses a model repository with an attacker-chosen directory name. Requires local access and low privileges.
What to do
No vendor fix is confirmed. Do not pass untrusted repository paths to OpenLLM, run it as an unprivileged user in a container, and track the upstream issue before treating it as remediated.
References
Related entries
- JupyterHub: unauthenticated logins write unbounded usernames to the log, exhausting storageCVE-2026-54338 · JupyterHub form-based login authenticators (failed-login logging)Medium
- vLLM: malformed JSON to the OpenAI-compatible endpoints returns server paths and versionsCVE-2026-73555 · vLLM OpenAI-compatible API server (validation_exception_handler, sanitize_message)Medium
- vLLM: attacker-supplied structured-output regex pins a CPU core and stalls the engine pathCVE-2026-73556 · vLLM structured outputs, lm-format-enforcer backend (structured_outputs.regex)Medium
- vLLM: integer overflow in the activation CUDA kernel leaks another batched request's outputCVE-2026-73558 · vLLM CUDA activation kernels (act_and_mul_kernel, activation_kernels.cu)Medium
- vLLM (DeepStream video backend, VideoMediaIO backend selection): A performance feature merged past two existingNCVD-2026-044-vllm-deepstream-video-backend-vi · vLLM (DeepStream video backend, VideoMediaIO backend selection)Medium
- NVIDIA OpenShell for Linux: improper output encoding in the inference proxy leaks data and allows tamperingCVE-2026-65085 · NVIDIA OpenShell for Linux (inference proxy)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.