CVE-2026-33744: Command Injection in BentoML Docker Containerization

An attacker can exploit this vulnerability by crafting a malicious bentofile.yaml file. This file, when used with the bentoml containerize or docker build commands, will inject arbitrary shell commands into the Dockerfile. Successful exploitation allows the attacker to execute commands within the container's build environment, potentially gaining control over the container image and any subsequent deployments. This could lead to data exfiltration, malware installation, or disruption of AI model serving infrastructure. The blast radius extends to any system relying on BentoML-built container images, particularly those involved in sensitive AI applications.

1. Reserved2026-03-23
2. Published2026-03-27
3. Modified2026-04-01
4. EPSS updated2026-04-03

The primary mitigation is to upgrade BentoML to version 1.4.37 or later, which includes a fix for the vulnerability. If upgrading immediately is not feasible, consider implementing input validation on the docker.systempackages field to prevent the injection of malicious commands. While not a complete solution, restricting the allowed characters or validating against a whitelist of known package names can reduce the attack surface. Review existing bentofile.yaml files for suspicious entries. There are no specific WAF rules or detection signatures readily available, so focusing on secure coding practices and timely patching is crucial. After upgrading, confirm the fix by attempting to build a container image with a bentofile.yaml containing a deliberately malicious systempackages entry; the build should fail with an error indicating invalid input.