{"id":"CVE-2024-2912","kind":"vulnerability","aliases":["CVE-2024-2912","GHSA-hvj5-mvw9-93j3"],"related":[],"title":"Insecure deserialization in BentoML","description":"An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.","summary":"BentoML, a Python framework for serving machine learning models, deserializes attacker-supplied objects in requests sent to any valid endpoint. A crafted serialized object runs operating system commands on the server when it is deserialized.","severity":"critical","cvss":10.0,"epss":0.01509,"exploited":false,"exploited_at":null,"products":[{"name":"bentoml","fixed":["1.2.5"],"affected":"< 1.2.5","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["bentoml","cwe-1188","ml-serving","package","python","self-hosted"],"not_affected_if":["fixed-version"],"how_to_check":"- Run `pip show bentoml` and check whether the version is below `1.2.5`\n- Search the lockfiles and requirements for `bentoml` pinned below `1.2.5`","fix":"- Upgrade the `bentoml` package to `1.2.5` or later\n- Redeploy any BentoML service images or containers after upgrading","status":"open","published_at":"2024-04-16T00:15:11+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","triaged_at":"2026-10-27T15:19:00+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T15:19:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `bentoml` package to `1.2.5` or later\n- Redeploy any BentoML service images or containers after upgrading","reach":"network","title":"BentoML: insecure deserialization lets a crafted POST run server commands","impact":"high","summary":"BentoML, a Python framework for serving machine learning models, deserializes attacker-supplied objects in requests sent to any valid endpoint. A crafted serialized object runs operating system commands on the server when it is deserialized.","category":"package","nicknames":[],"who_cares":["python","bentoml","self-hosted","ml-serving"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary OS commands on the server hosting BentoML","analyst_note":"","how_to_check":"- Run `pip show bentoml` and check whether the version is below `1.2.5`\n- Search the lockfiles and requirements for `bentoml` pinned below `1.2.5`","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Any service built on BentoML before 1.2.5 is exposed, because the flaw sits in request handling for every endpoint rather than in an optional feature. Teams running BentoML model servers on machines reachable from the network should treat them as at risk. Teams not running BentoML, or running a fixed version, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000597,"input_tokens":3429,"output_tokens":508,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1188':19B '-2024':6A,14A '-2912':7A,15A '93j3':12A 'access':140C 'allow':73C 'applic':100C 'arbitrari':92C 'attack':39B,89C,131C 'attacker-suppli':38B 'bentoml':4A,16A,17B,28B,71C,99C,121C 'code':75C 'command':56B,93C,113C 'compromis':133C 'control':142C 'craft':50B,82C,109C 'cve':5A,13A 'cwe':18B 'deseri':2A,37B,63B,66C,115C 'enabl':130C 'endpoint':48B,122C 'execut':76C,91C,111C 'exist':68C 'exploit':86C 'framework':31B,72C 'gain':138C 'ghsa':9A 'ghsa-hvj5-mvw9-93j3':8A 'host':27B,97C 'hvj5':10A 'insecur':1A,65C 'issu':124C 'learn':35B 'machin':34B 'ml':21B 'ml-serv':20B 'model':36B 'mvw9':11A 'object':41B,52B,108C 'oper':54B 'os':112C 'packag':23B 'pose':125C 'post':83C 'potenti':137C 'python':24B,30B 'rce':77C 'remot':74C 'request':43B,84C 'risk':129C 'run':53B 'secur':128C 'self':26B 'self-host':25B 'send':79C 'sent':44B,117C 'serial':51B,107C 'serv':22B,33B 'server':59B,96C,135C 'signific':127C 'special':81C 'suppli':40B 'system':55B 'trigger':104C 'unauthor':139C 'upon':114C 'valid':47B,120C 'vulner':67C,88C,102C","nicknames":[],"mitigations":[],"who_affected":"Any service built on BentoML before 1.2.5 is exposed, because the flaw sits in request handling for every endpoint rather than in an optional feature. Teams running BentoML model servers on machines reachable from the network should treat them as at risk. Teams not running BentoML, or running a fixed version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-16T00:15:11+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hvj5-mvw9-93j3","url":"https://github.com/advisories/GHSA-hvj5-mvw9-93j3","severity":"critical","published_at":"2024-04-16T00:30:33+00:00","modified_at":"2026-10-27T15:13:54+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","fetched_at":"2026-10-27T15:18:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-2912","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2912","severity":null,"published_at":"2024-04-16T00:15:11+00:00","modified_at":"2026-06-17T07:25:48+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}