GHSA-mcfx-4vc6-qgxv: BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

Summary

BentoML's `bentoml build` packaging workflow follows symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. The `os.walk` loop in the packaging code calls `shutil.copy` without checking that the resolved path stays inside `ctx_path`. An attacker who gets a developer or CI system to build an attacker-controlled repository can exfiltrate local files such as cloud credentials or SSH keys, and the leak can spread through export, push, or containerization. The issue was verified against BentoML 1.4.38.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• bentomlPyPINo LLM dependency detected · 1 tracked dependent

Related items

• HighCVE-2026-63651: LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect…Similar attack · NVD/CVE Database
• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• MediumCVE-2026-83953 GitHub Copilot for Jetbrains Information Disclosure VulnerabilitySimilar attack · MSRC Security Update Guide
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database
• MediumGHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolationSimilar attack · GitHub Advisory Database