Advisoriesby Ibis
BentoML security advisories
17 advisories · 8 critical or high in 12 months · latest Jul 8
17 advisories
BentoML: command injectionCVE-2026-15035no fix yetBentoML: command injectionCVE-2026-44346fixed in 1.4.39BentoML: command injectionCVE-2026-44345fixed in 1.4.39BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build contextCVE-2026-40610fixed in 1.4.39BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile GenerationCVE-2026-35044fixed in 1.4.38BentoML: Command Injection in cloud deployment setup scriptCVE-2026-35043fixed in 1.4.38BentoML has Dockerfile Command Injection via system_packages in bentofile.yamlCVE-2026-33744fixed in 1.4.37BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar ExtractionCVE-2026-27905fixed in 1.4.36BentoML has a Path Traversal via Bentofile ConfigurationCVE-2026-24123fixed in 1.4.34BentoML SSRF Vulnerability in File Upload ProcessingCVE-2025-54381fixed in 1.4.19BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure DeserializationCVE-2025-32375fixed in 1.4.8BentoML Allows Remote Code Execution (RCE) via Insecure DeserializationCVE-2025-27520fixed in 1.4.3BentoML deserialization vulnerabilityCVE-2024-9070no fix yetBentoML Denial of Service (DoS) via Multipart BoundaryCVE-2024-9056no fix yetBentoML Open Redirect vulnerabilityGHSA-564p-rx2q-4c8vno fix yetBentoML vulnerable to Uncontrolled Resource ConsumptionGHSA-hh3j-9m59-p8vcno fix yetInsecure deserialization in BentoMLCVE-2024-2912fixed in 1.2.5