Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a command injection flaw in BentoML's containerization feature. It arises from insufficient sanitization of the docker.system_packages field in the bentofile.yaml configuration file. User-provided values from this field are directly interpolated into shell commands within the generated Dockerfile, leading to arbitrary command execution during the image build process (bentoml containerize).
The analysis of the patch between the vulnerable version (1.4.36) and the patched version (1.4.37) revealed two key code paths where this vulnerability was present and subsequently fixed:
Image.system_packages in src/_bentoml_sdk/images.py: This Python method directly formatted a list of package names into an install_command string without any escaping. The fix was to apply shlex.quote() to each package name, which safely escapes shell metacharacters.
generate_containerfile in src/bentoml/_internal/container/generate.py: This function renders various Dockerfile templates (e.g., base_debian.j2, base_alpine.j2). The templates were joining the system_packages list directly into the RUN command. The fix involved modifying the Jinja2 templates to apply a bash_quote filter to each package name, which serves the same purpose as shlex.quote.
Both functions are responsible for processing the same malicious input and embedding it into a shell command context, making them the core of the vulnerability. Exploitation would cause one of these functions to appear in the call stack leading up to the execution of the docker build command.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bentoml | pip | <= 1.4.36 | 1.4.37 |
