AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

bentoml

BentoML: The easiest way to serve AI apps and models

Does not declare an LLM SDK itself, but depends on a package that does, 2 steps away.

PyPILatest 1.4.39First release 2019-01-15Registry page RepositoryChecked 2026-10-09

Advisories

Advisories that name bentoml as affected. Advisory records do not state an ecosystem, so packages with the same name in other ecosystems also match. For a version-exact check of your own dependencies, use Stack Check.

Advisory	Severity	Affected	Fixed in	Published
CVE-2026-44346GHSA-w2pm-x38x-jp44: Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)	High	<= 1.4.38	1.4.39	2026-05-11
CVE-2026-44345GHSA-78f9-r8mh-4xm2: BentoML Dockerfile command injection via docker.base_image (sister of pending GHSA-w2pm-x38x-jp44 / CVE-2026-33744 / CVE-2026-35043)	High	<= 1.4.38	1.4.39	2026-05-11
CVE-2026-40610GHSA-mcfx-4vc6-qgxv: BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context	Medium	<= 1.4.38	1.4.39	2026-05-07
CVE-2026-35044GHSA-v959-cwq9-7hr6: BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation	High	<= 1.4.37	1.4.38	2026-04-03
CVE-2026-35043GHSA-fgv4-6jr3-jgfw: BentoML: Command Injection in cloud deployment setup script	High	<= 1.4.37	1.4.38	2026-04-03
CVE-2026-33744GHSA-jfjg-vc52-wqvf: BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml	High	<= 1.4.36	1.4.37	2026-03-26
CVE-2026-27905GHSA-m6w7-qv66-g3mf: BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction	High	< 1.4.36	1.4.36	2026-03-03

How it reaches an LLM package

Shortest path through the runtime dependencies of each latest release.

Dependencies of the latest release

As declared in PyPI metadata for version 1.4.39. Optional extras are listed with their extra name.

bentoml-unsloth[unsloth]reaches LLM
pandas[all]reaches LLM
fsspecreaches LLM
s3fs[all]reaches LLM
aiosqlitereaches LLM
click-option-groupreaches LLM
httpxreaches LLM
kantokureaches LLM
pillow[all]reaches LLM
pip-requirements-parserreaches LLM
prometheus-clientreaches LLM
psutilreaches LLM
richreaches LLM
simple-direaches LLM
aiohttpreaches LLM
cattrsreaches LLM
httpx-wsreaches LLM
jinja2reaches LLM
opentelemetry-exporter-otlp-proto-http[all]reaches LLM
opentelemetry-instrumentationreaches LLM
opentelemetry-instrumentation-aiohttp-clientreaches LLM
opentelemetry-instrumentation-asgireaches LLM
opentelemetry-instrumentation-grpc[all]reaches LLM
pydanticreaches LLM
rich-toolkitreaches LLM
starlettereaches LLM
tritonclient[triton]reaches LLM
watchfilesreaches LLM
a2wsgi
aiohttp-asgi-connector
attrs
click
cloudpickle
grpcio[all]
grpcio-channelz[all]
grpcio-health-checking[all]
grpcio-reflection[all]
numpy
nvidia-ml-py
opentelemetry-api
opentelemetry-exporter-jaeger[all]
opentelemetry-exporter-otlp[all]
opentelemetry-exporter-otlp-proto-grpc[all]
opentelemetry-exporter-zipkin[all]
opentelemetry-sdk
opentelemetry-semantic-conventions
opentelemetry-util-http
packaging
pathspec
protobuf[all]
pyarrow[all]
python-dateutil
python-json-logger
python-multipart
pyyaml
schema
tomli
tomli-w
uvicorn

Tracked packages that depend on it

Among the packages in the registry; not every dependent on PyPI.

bentoml-unsloth