Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

bentoml

15 known vulnerabilities (5 critical, 8 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
1.4.40 (Oct 23, 2026): no advisory affects it
Newest unaffected release
1.4.40 (Oct 23, 2026), the latest release
Advisories
15 · 5 critical, 8 high, 2 medium
Weekly downloads
51.1K
Dependents
23
Releases
220 since 0.0.1 (Jan 15, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 15 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

  • CVE-2026-15035Medium 4.8

    bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection

    Affected: through 0.6.30.

    Fixed in 0.7.0 (released Apr 3, 2020, 2287 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.4.40, is not affected.

  • BentoML: Dockerfile command injection via docker.base_image

    Affected: fixed in 1.4.39.

    Fixed in 1.4.39 (released May 7, 2026, 20 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml

    Affected: fixed in 1.4.39.

    Fixed in 1.4.39 (released May 7, 2026, 20 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • CVE-2026-40610Medium 5.5

    BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

    Affected: fixed in 1.4.39.

    Fixed in 1.4.39 (released May 7, 2026, 15 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation

    Affected: fixed in 1.4.38.

    Fixed in 1.4.38 (released Apr 2, 2026, 4 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • BentoML: command injection in cloud deployment setup script (deployment.py)

    Affected: fixed in 1.4.38.

    Fixed in 1.4.38 (released Apr 2, 2026, 4 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

    Affected: fixed in 1.4.37.

    Fixed in 1.4.37 (released Mar 25, 2026, 2 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction

    Affected: fixed in 1.4.36.

    Fixed in 1.4.36 (released Mar 6, 2026, 3 days after disclosure).

    The latest release, 1.4.40, is not affected.

  • BentoML has a Path Traversal via Bentofile Configuration

    Affected: fixed in 1.4.34.

    Fixed in 1.4.34 (released Jan 26, 2026, the day of disclosure).

    The latest release, 1.4.40, is not affected.

  • CVE-2025-54381Critical 9.9

    BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

    Affected: from 1.4.0, fixed in 1.4.19.

    Fixed in 1.4.19 (released Jul 29, 2025, the day of disclosure).

    The latest release, 1.4.40, is not affected.

  • CVE-2025-32375Critical 9.8

    Insecure Deserialization leads to RCE in BentoML's runner server

    Affected: from 1.0.0, fixed in 1.4.8; from 1.0.0a1, fixed in 1.4.8.

    Fixed in 1.4.8 (released Apr 8, 2025, 1 day before disclosure).

    The latest release, 1.4.40, is not affected.

  • CVE-2025-27520Critical 9.8

    BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

    Affected: from 1.3.4, fixed in 1.4.3.

    Fixed in 1.4.3 (released Mar 6, 2025, 29 days before disclosure).

    The latest release, 1.4.40, is not affected.

  • CVE-2024-9070Critical 9.8

    Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml

    Affected: through 1.4.5.

    Fixed in 1.4.6 (released Mar 25, 2025, 5 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.4.40, is not affected.

  • Denial of Service in bentoml/bentoml

    Affected: through 1.4.5.

    Fixed in 1.4.6 (released Mar 25, 2025, 5 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.4.40, is not affected.

  • CVE-2024-2912Critical 10.0

    Insecure Deserialization Leading to RCE in bentoml/bentoml

    Affected: fixed in 1.2.5.

    Fixed in 1.2.5 (released Mar 5, 2024, 42 days before disclosure).

    The latest release, 1.4.40, is not affected.