GHSA-w2pm-x38x-jp44: Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)

Summary

A crafted bentofile.yaml with a newline-injected envs[*].name value makes the BentoML-generated Dockerfile contain unquoted RUN directives, which execute on the build host when the victim runs bentoml containerize on the imported bento. The flaw is in base_v2.j2 lines 71-73, where env.name is interpolated without bash_quote, and it affects bentoml 1.4.38 (verified) and likely all 1.x versions with _bentoml_impl/docker.py. It is a sibling of CVE-2026-33744 and CVE-2026-35043, whose fixes covered only system_packages.

Mitigation

Apply the bash_quote filter to env.name in base_v2.j2 lines 71-73 (both the ARG and ENV lines), and validate envs[*].name at the schema level in bentoml/_internal/bento/build_config.py:BentoEnvSchema with the regex ^[A-Za-z_][A-Za-z0-9_]*$ so newline and shell-metacharacter values are rejected at config load.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• bentomlPyPINo LLM dependency detected · 1 tracked dependent

Related items

• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
• MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online
• HighCVE-2026-88981: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0…Similar attack · NVD/CVE Database
• MediumBinance heist is stark example of AI governance gaps and basic security failuresSimilar attack · CSO Online