Remote Code Execution Vulnerability in BentoML Python Library
CVE-2026-35043

7.8HIGH

Key Information:

Vendor

Bentoml

Status
Bentoml
Vendor
CVE Published:
6 April 2026

What is CVE-2026-35043?

A vulnerability exists in BentoML, a Python library designed for building online serving systems optimized for AI applications and model inference. In versions prior to 1.4.38, an issue in the cloud deployment path allows for the execution of untrusted commands due to improper handling of system_packages in a shell command. The service utilizes an f-string for command interpolation without appropriate quoting, posing a risk for remote code execution during deployment as the generated script is uploaded and executed on the cloud build infrastructure. Users are advised to upgrade to version 1.4.38 or higher to mitigate this issue.

Affected Version(s)

BentoML < 1.4.38

References

https://github.com/bentoml/BentoML/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.