{"data":{"id":"dbbcb1b5-d0bd-4baa-aef2-cfc20bf086bf","title":"CVE-2025-27520: BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote…","summary":"CVE-2025-27520 is a remote code execution flaw in BentoML, a Python library for building online serving systems for AI apps and model inference. Insecure deserialization (CWE-502) in an unsafe code segment in serde.py, present in v1.4.2, lets any unauthenticated user execute arbitrary code on the server.","solution":"This vulnerability is fixed in 1.4.3.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-27520","publishedAt":"2025-04-04T19:15:47.927Z","cveId":"CVE-2025-27520","cweIds":["CWE-502"],"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["bentoml@>= 1.3.4, < 1.4.3 (fixed: 1.4.3)"],"affectedPackageNames":["bentoml"],"affectedPackageRefs":["pypi:bentoml"],"affectedVendors":[],"affectedVendorsRaw":["BentoML"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"BentoML remote code execution through insecure deserialization","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.4062,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-33xw-247w-6hmc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:00.931Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-03-06T01:17:01.826Z","daysToFix":-29,"fixCheckedAt":"2026-10-29T21:44:46.815Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"bentoml","fixedVersion":"1.4.3","matchedVersion":"1.4.3","fixReleasedAt":"2025-03-06T01:17:01.826Z","daysToFix":-29,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:46.662Z"}]}}