GHSA-78f9-r8mh-4xm2: BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)

Summary

GHSA-78f9-r8mh-4xm2 reports that the BentoML Dockerfile template interpolates `docker.base_image` without escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line `docker.base_image` value injects extra Dockerfile directives, and `bentoml containerize` runs `docker build`, which executes the injected `RUN` directives on the victim host. The source describes this as a sister issue to pending GHSA-w2pm-x38x-jp44.

Mitigation

Suggested fix: validate `DockerOptions.base_image` at the config layer by rejecting values containing newline characters (`\n`, `\r`) or whitespace beyond a single space-separated tag, for example with the regex `^[A-Za-z0-9._/-]+(:[A-Za-z0-9._-]+)?(@sha256:[a-f0-9]{64})?$`. The source also recommends extending the same hardening to `__options__build_include[*]` at line 97 of `base_v2.j2` and to `bento__user`, `bento__uid_gid`, `bento__path`, `bento__home`, and `bento__entrypoint` if they become user-overridable through `override_bento_env`.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• bentomlPyPINo LLM dependency detected · 1 tracked dependent

Related items

• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
• MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online
• HighCVE-2026-88981: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0…Similar attack · NVD/CVE Database
• MediumBinance heist is stark example of AI governance gaps and basic security failuresSimilar attack · CSO Online