BentoML (cloud deployment path, setup.sh generation in deployment.py): The March fix that added shlex.quote to the

CVE-2026-35043AI/ML frameworks & servingGHSA-fgv4-6jr3-jgfwcurated

Impact

The March fix that added shlex.quote to the Dockerfile path never reached the cloud deployment code, so system_packages is still interpolated raw into a shell command. The generated setup.sh is uploaded to BentoCloud and executed on the build machine, giving the attacker command execution on the shared cloud builder rather than only on the developer's laptop.

Who can reach it

Anyone who can supply the bentofile a victim deploys - a contributed repo, a shared project, or a compromised branch. Requires the victim to run the cloud deployment flow.

What to do

Upgrade BentoML to 1.4.38 or later. Treat the whole family of these injection bugs (CVE-2026-33744, CVE-2026-35044, CVE-2026-44345, CVE-2026-44346) as one patch decision and land the newest release rather than the individual minimum fix.

References

https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw https://nvd.nist.gov/vuln/detail/CVE-2026-35043

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.