Docker Build Vulnerability in BentoML Python Library

CVE-2026-44346

What is CVE-2026-44346?

The BentoML Python library, designed for developing online serving systems tailored for AI applications, has a vulnerability that arises before version 1.4.39. This issue occurs when a crafted bentofile.yaml file contains a newline-injected value in the envs[*].name field. Such manipulation causes unquoted RUN directives to appear in the Dockerfile generated by BentoML. Consequently, executing bentoml containerize on the compromised bento can lead to the execution of unintended commands on the host machine during the Docker build process. Users are urged to upgrade to version 1.4.39 or later to mitigate this security risk.

References