External risk intelligence

BentoML Jinja2 Template Injection Arbitrary Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-35044

The vulnerability exists within the BentoML library's build-time container generation function (generate_containerfile). It requires a user to manually import a malicious archive and execute the containerize command on their local machine or development environment. It is not an internet-facing service or reachable network endpoint in standard deployments.

Bentoml

before 1.4.38

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the BentoML library, a tool used for serving AI applications. The issue allows for arbitrary code execution on the host machine if a user imports a specially crafted archive and runs a specific command, bypassing container isolation. The main concern is to confirm if BentoML is in use and if the affected versions are deployed within the organization.

Malicious code can run directly on your machine.
Confirms if BentoML is used and vulnerable.
Assess use and impact to ensure relevance.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into importing a malicious BentoML archive and then running the `bentoml containerize` command. This would cause the system to execute attacker-controlled code within a Jinja2 template, leading to arbitrary Python execution on the host machine and bypassing container isolation.

Requires user to import malicious archive.
Triggered by running `bentoml containerize`.
Allows arbitrary code execution on host.

Live Threat

Current exploitation, exposure, and threat context

When a user imports a malicious Bento archive and runs the `bentoml containerize` command, attacker-controlled Jinja2 template code could execute arbitrary Python directly on the host machine, bypassing container isolation, when the affected function is used with user-provided templates.

Arbitrary Python code execution on host.
Malicious Bento archive import and containerize.
Complete system compromise or data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation of this vulnerability likely involves collaboration between the application owners responsible for AI model deployment pipelines and the platform or infrastructure teams managing the BentoML environment. The first practical step is to inventory all instances where BentoML is used for containerizing AI models, determine which of these are actively processing user-supplied archives or templates, and confirm if they are exposed to untrusted input. Once identified, the accountable owner should be engaged to plan remediation, prioritizing critical or exposed systems.

Application owners and platform teams.
Verify all BentoML containerize uses.
Plan and coordinate remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BentoML?

BentoML is a Python library widely used by developers to package and deploy AI models. It provides tools to wrap models into standardized serving systems, making it easier to run machine learning services in containerized environments like Docker.

What does CVE-2026-35044 mean by improper neutralization?

This vulnerability is classified as CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine. It means the library fails to properly secure its Jinja2 template processing. An attacker can insert malicious code into a template file, which the library then executes as if it were legitimate instructions during the container creation process.

How is this vulnerability triggered?

The vulnerability requires an active, intentional action: importing an untrusted or malicious Bento archive and manually executing the `bentoml containerize` command. It is not triggered by simply having the library installed or by receiving network traffic; the code must be run locally or in a development environment using a compromised template.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely for most users. Because the flaw exists only in a specific build-time function used during manual containerization, it does not create an internet-facing network endpoint. It typically requires a user to perform an action within a local or development workflow.

Do I need to update my BentoML version?

Yes, if you use BentoML, you should verify your version and update to 1.4.38 or later. The first step is to inventory where BentoML is used in your infrastructure for containerizing models. Focus your efforts on environments where you process model archives from third parties or untrusted sources.

References

github.com/bentoml/BentoML/security/advisories/GHSA-v959-cwq9-7hr6

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.