{"data":{"id":"92358181-5eb3-440e-a206-c36b157cc235","title":"GHSA-78f9-r8mh-4xm2: BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)","summary":"GHSA-78f9-r8mh-4xm2 reports that the BentoML Dockerfile template interpolates `docker.base_image` without escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line `docker.base_image` value injects extra Dockerfile directives, and `bentoml containerize` runs `docker build`, which executes the injected `RUN` directives on the victim host. The source describes this as a sister issue to pending GHSA-w2pm-x38x-jp44.","solution":"Suggested fix: validate `DockerOptions.base_image` at the config layer by rejecting values containing newline characters (`\\n`, `\\r`) or whitespace beyond a single space-separated tag, for example with the regex `^[A-Za-z0-9._/-]+(:[A-Za-z0-9._-]+)?(@sha256:[a-f0-9]{64})?$`. The source also recommends extending the same hardening to `__options__build_include[*]` at line 97 of `base_v2.j2` and to `bento__user`, `bento__uid_gid`, `bento__path`, `bento__home`, and `bento__entrypoint` if they become user-overridable through `override_bento_env`.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-78f9-r8mh-4xm2","publishedAt":"2026-05-11T14:27:06.000Z","cveId":"CVE-2026-44345","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["bentoml@<= 1.4.38 (fixed: 1.4.39)"],"affectedPackageNames":["bentoml"],"affectedPackageRefs":["pypi:bentoml"],"affectedVendors":[],"affectedVendorsRaw":["BentoML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00317,"epssCheckedAt":"2026-11-07T06:14:04.216Z","kevDateAdded":null,"advisoryAliases":["GHSA-78f9-r8mh-4xm2"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-11T14:27:06.000Z","fixReleasedAt":"2026-05-07T10:38:13.384Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:36:34.732Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"bentoml","fixedVersion":"1.4.39","matchedVersion":"1.4.39","fixReleasedAt":"2026-05-07T10:38:13.384Z","daysToFix":-4,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:34.584Z"}]}}