---
id: "CVE-2026-112264"
kind: "vulnerability"
aliases: ["CVE-2026-112264"]
title: "BentoML: Dockerfile newline injection runs attacker build commands during containerize"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bentoml", "fixed": [], "affected": "<= 1.4.39", "ecosystem": "PyPI"}]
ecosystems: []
tags: ["bentoml", "build-host", "docker", "ml-serving", "package", "python", "supply-chain"]
not_affected_if: ["bentofiles-written-in-house", "list-form-env", "no-containerize", "no-untrusted-bento-archives", "trusted-bentofile-only"]
published_at: "2026-10-19T14:17:03+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:41:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112264", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:41:39+00:00"}]
---

# BentoML: Dockerfile newline injection runs attacker build commands during containerize

BentoML through 1.4.39 renders docker.env keys into a Dockerfile without escaping newlines, so a crafted bentofile.yaml or imported bento archive can inject RUN instructions. When bentoml containerize runs docker build, the injected commands execute, letting an attacker reach build secrets and poison the resulting image.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- PyPI:bentoml affected <= 1.4.39 fixed ?

## How to check

1. Run 'pip show bentoml'. 1.4.39 and earlier are affected; 1.4.40 is not confirmed fixed. 2. Grep bentofile.yaml files and imported bento archives for a docker.env written as a mapping (key: value) rather than a list. Keys containing a newline are the attack. 3. The legacy base.j2 template is used when docker.base_image is set. 4. Read the generated Dockerfile before docker build and look for unexpected RUN lines.

## Fix

No confirmed fixed release. Latest is 1.4.40 and its notes do not mention this issue; the candidate fix (PR #5700) was closed unmerged by its author, issue #5656 is still open. Until the maintainers confirm: do not run bentoml containerize on bentofile.yaml or bento archives from untrusted sources, and review docker.env.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112264
- 2026-10-25T03:41:39+00:00 analyst — Read VulnCheck advisory (CNA), reporter's PoC writeup, BentoML issue #5656, v1.4.40 release notes. No vendor GHSA for this CVE; reporter got no response. No confirmed fixed version: 1.4.40 (2026-10-23) notes don't mention it; PR #5700 was closed by its author. Public PoC exists; no exploitation reported. Nothing marked verified (no vendor/maintainer statement of fix).

## Documents

- [advisory] VulnCheck: BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys https://www.vulncheck.com/advisories/bentoml-through-1.4.39-dockerfile-instruction-injection-via-docker-env-keys
- [discussion] BentoML #5656: Dockerfile injection via unsanitized docker.env dict values (open) https://github.com/bentoml/BentoML/issues/5656
- [mentions] BentoML v1.4.40 release notes https://github.com/bentoml/BentoML/releases/tag/v1.4.40
- [poc] George Chen report and PoC: docker.env dict key injection in base.j2 https://github.com/geo-chen/oss/blob/main/BentoML.md

## From the sources

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_