{"data":{"id":"1e895207-2487-4440-bf75-87b53725236f","title":"CVE-2024-2912: An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by…","summary":"CVE-2024-2912 is an insecure deserialization flaw in the BentoML framework. A specially crafted POST request carrying a serialized object sent to any valid BentoML endpoint lets an attacker run arbitrary OS commands on the hosting server, enabling remote code execution and potential unauthorized access or control.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-2912","publishedAt":"2024-04-16T04:15:11.427Z","cveId":"CVE-2024-2912","cweIds":["CWE-1188"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["bentoml@< 1.2.5 (fixed: 1.2.5)"],"affectedPackageNames":["bentoml"],"affectedPackageRefs":["pypi:bentoml"],"affectedVendors":[],"affectedVendorsRaw":["BentoML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"BentoML insecure deserialization leading to remote code execution via POST","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01509,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-hvj5-mvw9-93j3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:12.162Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-03-05T09:23:06.377Z","daysToFix":-42,"fixCheckedAt":"2026-10-29T21:46:08.493Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"bentoml","fixedVersion":"1.2.5","matchedVersion":"1.2.5","fixReleasedAt":"2024-03-05T09:23:06.377Z","daysToFix":-42,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:08.340Z"}]}}