BentoML (cloud deployment path, setup.sh generation in deployment.py): The March fix that added shlex.quote to the

Impact

The March fix that added shlex.quote to the Dockerfile path never reached the cloud deployment code, so system_packages is still interpolated raw into a shell command. The generated setup.sh is uploaded to BentoCloud and executed on the build machine, giving the attacker command execution on the shared cloud builder rather than only on the developer's laptop.

Who can reach it

Anyone who can supply the bentofile a victim deploys - a contributed repo, a shared project, or a compromised branch. Requires the victim to run the cloud deployment flow.

What to do

Upgrade BentoML to 1.4.38 or later. Treat the whole family of these injection bugs (CVE-2026-33744, CVE-2026-35044, CVE-2026-44345, CVE-2026-44346) as one patch decision and land the newest release rather than the individual minimum fix.

References

Related entries

• SGLang (`replay_request_dump.py`): Insecure `pickle.load()` on a `.pkl` dumpCVE-2026-3989 · SGLang (`replay_request_dump.py`)High
• llama.cpp (`llama_batch_init`): Integer overflow from unchecked multiplicationCVE-2026-43627 · llama.cpp (`llama_batch_init`)High
• HuggingFace transformers: Critical RCE in all versions before 5.3.0CVE-2026-4372 · HuggingFace transformersHigh
• stable-diffusion.cpp: Memory-safety flaw in model loadingCVE-2026-47749 · stable-diffusion.cppHigh
• PyTorch Lightning (`_load_state`): RCE by importing and executing classes named in the checkpointCVE-2026-58659 · PyTorch Lightning (`_load_state`)High
• NVIDIA Megatron Bridge: deserialization of untrusted checkpoints or configs gives code executionCVE-2026-61750 · NVIDIA Megatron BridgeHigh