Live › vulnerability › CVE-2026-112264
Go to dashboardBentoML through 1.4.39 renders docker.env keys into a Dockerfile without escaping newlines, so a crafted bentofile.yaml or imported bento archive can inject RUN instructions. When bentoml containerize runs docker build, the injected commands execute, letting an attacker reach build secrets and poison the resulting image.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run bentoml containerize on bentofile.yaml files or bento archives they did not write themselves, such as community models or files pulled from shared storage. Teams that only build from their own reviewed bentofiles with no untrusted docker.env keys are less exposed, though the sources do not state a patched version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| bentoml | PyPI | <= 1.4.39 | – |
1.4.40 and its notes do not mention this issue; the candidate fix (PR #5700) was closed unmerged by its author, issue #5656 is still openEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.
This page as .md · .json · in your agent: get_signal("CVE-2026-112264")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.