{"data":{"id":"9da1ba88-0695-45c0-aae3-13f48f849de1","title":"GHSA-jfjg-vc52-wqvf: BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml","summary":"BentoML's docker.system_packages field in bentofile.yaml accepts arbitrary strings that are interpolated unescaped into Dockerfile RUN commands. A crafted bentofile.yaml therefore executes attacker-chosen shell commands during bentoml containerize or docker build, including in CI/CD pipelines and when BentoCloud builds user-supplied configs. The flaw affects all versions supporting that field, confirmed on 1.4.36.","solution":"Option 1 (recommended): add a regex validator to system_packages in src/bentoml/_internal/bento/build_config.py that permits only alphanumeric characters, dots, plus signs, hyphens, underscores and colons in package names. Option 2: apply shlex.quote() to each package name before interpolation in images.py:system_packages() and apply the bash_quote Jinja2 filter in base_debian.j2.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-jfjg-vc52-wqvf","publishedAt":"2026-03-26T07:32:44.000Z","cveId":"CVE-2026-33744","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["bentoml@<= 1.4.36 (fixed: 1.4.37)"],"affectedPackageNames":["bentoml"],"affectedPackageRefs":["pypi:bentoml"],"affectedVendors":[],"affectedVendorsRaw":["BentoML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00261,"epssCheckedAt":"2026-11-09T18:09:53.339Z","kevDateAdded":null,"advisoryAliases":["GHSA-jfjg-vc52-wqvf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-26T07:32:44.000Z","fixReleasedAt":"2026-03-25T01:21:15.575Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:39:34.423Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"bentoml","fixedVersion":"1.4.37","matchedVersion":"1.4.37","fixReleasedAt":"2026-03-25T01:21:15.575Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:34.277Z"}]}}