8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44345

CVE-2026-44345: BentoML: Dockerfile command injection via docker.base_image

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2 interpolates docker.base_image raw with no escaping, newline filtering, or validation. A malicious bento.yaml with a multi-line docker.base_image value smuggles arbitrary Dockerfile directives into the generated Dockerfile, and bentoml containerize then runs docker build which executes the injected RUN directives on the victim host. This vulnerability is fixed in 1.4.39.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44345

CVE-2026-44345:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bentoml	pip	<= 1.4.38	1.4.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a command injection in BentoML's Dockerfile generation process. The docker.base_image field in the bento.yaml file is not properly sanitized before being included in the generated Dockerfile. An attacker can provide a multi-line string for docker.base_image that includes malicious Dockerfile RUN commands. When bentoml containerize is executed, these commands are written to the Dockerfile and then executed on the host during the docker build process.

The patch addresses this by introducing a normalize_line Jinja2 filter that strips newlines and collapses whitespace, effectively preventing the injection of additional Dockerfile directives. The functions generate_containerfile in src/bentoml/_internal/container/generate.py and generate_dockerfile in src/_bentoml_impl/docker.py are the key functions involved in this vulnerable process. They are responsible for taking the user-provided configuration and generating the Dockerfile. The patch modifies these functions and the templates they use to ensure the base_image is properly sanitized.

Vulnerable functions

generate_containerfile

src/bentoml/_internal/container/generate.py

This function generates a Dockerfile based on the `bento.yaml` configuration. The `docker.base_image` option was used without sanitization, allowing an attacker to inject arbitrary commands into the Dockerfile by providing a multi-line string with malicious Dockerfile directives. The `generate_containerfile` function orchestrates this process, making it the vulnerable function.

generate_dockerfile

src/_bentoml_impl/docker.py

This function is responsible for setting up the Jinja2 environment and rendering the Dockerfile template. Before the patch, it did not sanitize the `base_image` input, leading to the command injection vulnerability. The patch modifies this function to use a new environment with the `normalize_line` filter.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.