8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44346

CVE-2026-44346: BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. This vulnerability is fixed in 1.4.39.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44346

CVE-2026-44346:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bentoml	pip	<= 1.4.38	1.4.39

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the generation of Dockerfiles where environment variable names from the bentofile.yaml were used without proper sanitization. Specifically, the envs[*].name field was not escaped, allowing an attacker to inject newlines and arbitrary RUN commands into the resulting Dockerfile. When a user builds a container from this malicious bento using bentoml containerize, the injected commands execute on the host system.

The patch addresses this by introducing a new Jinja2 filter called normalize_line, which strips newlines and collapses whitespace, effectively preventing the injection. The core vulnerable functions, generate_dockerfile and generate_containerfile, were updated to use a new centralized Jinja2 environment (build_environment) where this sanitizing filter is applied to the env.name variable within the base_v2.j2 template. Any runtime profile during the exploitation of this vulnerability would show these functions being called to generate the malicious Dockerfile.

Vulnerable functions

generate_dockerfile

src/_bentoml_impl/docker.py

This function is responsible for generating a Dockerfile from a bento. It was using a Jinja2 environment that did not properly sanitize the 'env.name' field from the 'bentofile.yaml'. A malicious 'env.name' containing newlines could be used to inject arbitrary 'RUN' commands into the generated Dockerfile, leading to remote code execution when the image is built.

generate_containerfile

src/bentoml/_internal/container/generate.py

This function is a more generic utility for generating container files (like Dockerfiles). Similar to 'generate_dockerfile', it was creating its own Jinja2 environment without proper sanitization of template inputs. This made it vulnerable to the same command injection attack via a malicious 'env.name' in 'bentofile.yaml'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.