# bentoml (PyPI) vulnerabilities 15 known vulnerabilities (5 critical, 8 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.4.40 (Oct 23, 2026): no advisory affects it - Newest unaffected release: 1.4.40 (Oct 23, 2026), the latest release - Weekly downloads: 51.1K - Dependents: 23 - Releases: 220 since 0.0.1 (Jan 15, 2019) - Registry: https://pypi.org/project/bentoml/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-15035: 0.0.1 to 0.6.3 (0.7.0 is outside it) - CVE-2026-44345: 0.0.1 to 1.4.38 (1.4.39 is outside it) - CVE-2026-44346: 0.0.1 to 1.4.38 (1.4.39 is outside it) - CVE-2026-40610: 0.0.1 to 1.4.38 (1.4.39 is outside it) - CVE-2026-35044: 0.0.1 to 1.4.37 (1.4.38 is outside it) - CVE-2026-35043: 0.0.1 to 1.4.37 (1.4.38 is outside it) - CVE-2026-33744: 0.0.1 to 1.4.36 (1.4.37 is outside it) - CVE-2026-27905: 0.0.1 to 1.4.35 (1.4.36 is outside it) - CVE-2026-24123: 0.0.1 to 1.4.33 (1.4.34 is outside it) - CVE-2025-54381: 1.4.0 to 1.4.18 (1.4.19 is outside it) - CVE-2025-32375: 1.0.0a1 to 1.4.7 (1.4.8 is outside it) - CVE-2025-27520: 1.3.4.post1 to 1.4.2 (1.4.3 is outside it) - CVE-2024-9070: 0.0.1 to 1.4.5 (1.4.6 is outside it) - CVE-2024-9056: 0.0.1 to 1.4.5 (1.4.6 is outside it) - CVE-2024-2912: 0.0.1 to 1.2.4 (1.2.5 is outside it) ## Advisories (15) ### [CVE-2026-15035](https://cve.now/CVE-2026-15035): bentoml OpenLLM Model Repository Directory Name common.py async\_run\_command command injection - Severity: Medium 4.8 - Published: Jul 8, 2026 - Affected: through 0.6.30. - Fixed in 0.7.0 (released Apr 3, 2020, 2287 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.4.40, is not affected. ### [CVE-2026-44345](https://cve.now/CVE-2026-44345): BentoML: Dockerfile command injection via docker.base\_image - Severity: High 8.8 - Published: May 27, 2026 - Affected: fixed in 1.4.39. - Fixed in 1.4.39 (released May 7, 2026, 20 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-44346](https://cve.now/CVE-2026-44346): BentoML: Dockerfile command injection via envs\[\*\].name in bentofile.yaml - Severity: High 8.8 - Published: May 27, 2026 - Affected: fixed in 1.4.39. - Fixed in 1.4.39 (released May 7, 2026, 20 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-40610](https://cve.now/CVE-2026-40610): BentoML has Information Disclosure in \`bentoml build\` via symlink traversal in the build context - Severity: Medium 5.5 - Published: May 22, 2026 - Affected: fixed in 1.4.39. - Fixed in 1.4.39 (released May 7, 2026, 15 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-35044](https://cve.now/CVE-2026-35044): BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation - Severity: High 8.8 - Published: Apr 6, 2026 - Affected: fixed in 1.4.38. - Fixed in 1.4.38 (released Apr 2, 2026, 4 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-35043](https://cve.now/CVE-2026-35043): BentoML: command injection in cloud deployment setup script (deployment.py) - Severity: High 7.8 - Published: Apr 6, 2026 - Affected: fixed in 1.4.38. - Fixed in 1.4.38 (released Apr 2, 2026, 4 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-33744](https://cve.now/CVE-2026-33744): BentoML has Dockerfile Command Injection via system\_packages in bentofile.yaml - Severity: High 7.8 - Published: Mar 27, 2026 - Affected: fixed in 1.4.37. - Fixed in 1.4.37 (released Mar 25, 2026, 2 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-27905](https://cve.now/CVE-2026-27905): BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction - Severity: High 8.6 - Published: Mar 3, 2026 - Affected: fixed in 1.4.36. - Fixed in 1.4.36 (released Mar 6, 2026, 3 days after disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2026-24123](https://cve.now/CVE-2026-24123): BentoML has a Path Traversal via Bentofile Configuration - Severity: High 7.4 - Published: Jan 26, 2026 - Affected: fixed in 1.4.34. - Fixed in 1.4.34 (released Jan 26, 2026, the day of disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2025-54381](https://cve.now/CVE-2025-54381): BentoML is Vulnerable to an SSRF Attack Through File Upload Processing - Severity: Critical 9.9 - Published: Jul 29, 2025 - Affected: from 1.4.0, fixed in 1.4.19. - Fixed in 1.4.19 (released Jul 29, 2025, the day of disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2025-32375](https://cve.now/CVE-2025-32375): Insecure Deserialization leads to RCE in BentoML's runner server - Severity: Critical 9.8 - Published: Apr 9, 2025 - Affected: from 1.0.0, fixed in 1.4.8; from 1.0.0a1, fixed in 1.4.8. - Fixed in 1.4.8 (released Apr 8, 2025, 1 day before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2025-27520](https://cve.now/CVE-2025-27520): BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization - Severity: Critical 9.8 - Published: Apr 4, 2025 - Affected: from 1.3.4, fixed in 1.4.3. - Fixed in 1.4.3 (released Mar 6, 2025, 29 days before disclosure). - The latest release, 1.4.40, is not affected. ### [CVE-2024-9070](https://cve.now/CVE-2024-9070): Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml - Severity: Critical 9.8 - Published: Mar 20, 2025 - Affected: through 1.4.5. - Fixed in 1.4.6 (released Mar 25, 2025, 5 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.4.40, is not affected. ### [CVE-2024-9056](https://cve.now/CVE-2024-9056): Denial of Service in bentoml/bentoml - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: through 1.4.5. - Fixed in 1.4.6 (released Mar 25, 2025, 5 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.4.40, is not affected. ### [CVE-2024-2912](https://cve.now/CVE-2024-2912): Insecure Deserialization Leading to RCE in bentoml/bentoml - Severity: Critical 10.0 - Published: Apr 16, 2024 - Affected: fixed in 1.2.5. - Fixed in 1.2.5 (released Mar 5, 2024, 42 days before disclosure). - The latest release, 1.4.40, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/bentoml Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.