CVE-2026-112264

7.8High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Attackers can achieve arbitrary code execution during container builds, steal build secrets, and poison container images. They need you to run 'bentoml containerize' on a maliciously crafted bentofile.yaml or imported bento archive.

Root cause

The legacy base.j2 Jinja template renders docker.env mapping keys into Dockerfiles without stripping newlines, allowing command injection via extra Dockerfile instructions like RUN.

Affected systems

BentoML through 1.4.39

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to a fixed BentoML version beyond 1.4.39 once released. In the meantime, inspect and sanitize all bentofile.yaml files to ensure docker.env keys contain no newline characters before running containerization builds.

shell

$ pip install --upgrade bentoml

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112264