{"data":{"id":"b170c921-960c-4cdc-9de0-82cfd4a13632","title":"GHSA-w2pm-x38x-jp44: Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)","summary":"A crafted bentofile.yaml with a newline-injected envs[*].name value makes the BentoML-generated Dockerfile contain unquoted RUN directives, which execute on the build host when the victim runs bentoml containerize on the imported bento. The flaw is in base_v2.j2 lines 71-73, where env.name is interpolated without bash_quote, and it affects bentoml 1.4.38 (verified) and likely all 1.x versions with _bentoml_impl/docker.py. It is a sibling of CVE-2026-33744 and CVE-2026-35043, whose fixes covered only system_packages.","solution":"Apply the bash_quote filter to env.name in base_v2.j2 lines 71-73 (both the ARG and ENV lines), and validate envs[*].name at the schema level in bentoml/_internal/bento/build_config.py:BentoEnvSchema with the regex ^[A-Za-z_][A-Za-z0-9_]*$ so newline and shell-metacharacter values are rejected at config load.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-w2pm-x38x-jp44","publishedAt":"2026-05-11T14:27:37.000Z","cveId":"CVE-2026-44346","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["bentoml@<= 1.4.38 (fixed: 1.4.39)"],"affectedPackageNames":["bentoml"],"affectedPackageRefs":["pypi:bentoml"],"affectedVendors":[],"affectedVendorsRaw":["BentoML","bentoml 1.4.38"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00321,"epssCheckedAt":"2026-11-07T06:14:05.824Z","kevDateAdded":null,"advisoryAliases":["GHSA-w2pm-x38x-jp44"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-11T14:27:37.000Z","fixReleasedAt":"2026-05-07T10:38:13.384Z","daysToFix":-4,"fixCheckedAt":"2026-10-29T21:36:33.992Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"bentoml","fixedVersion":"1.4.39","matchedVersion":"1.4.39","fixReleasedAt":"2026-05-07T10:38:13.384Z","daysToFix":-4,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:33.846Z"}]}}