CVE-2026-35044

OVERVIEW CVE-2026-35044 is a critical code injection vulnerability in BentoML versions prior to 1.4.38. The flaw exists in the Dockerfile generation function, which uses an unsandboxed Jinja2 template environment with unsafe extensions enabled. When a user imports a malicious bento archive and executes the containerize command, arbitrary Python code embedded in the dockerfile template executes directly on the host system with no container isolation. SEVERITY The vulnerability presents a critical risk with a CVSS score of 9.6. It requires no special privileges or authentication from the attacker, can be triggered via network means, and demands minimal interaction from the victim. The attack completely bypasses container security boundaries, granting the attacker the ability to compromise system confidentiality, integrity, and availability. The attack chain is straightforward, requiring only that a victim import a compromised bento archive. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the CISA Known Exploited Vulnerabilities catalog. The exploit concept is practical and requires no complex preconditions beyond social engineering to distribute a malicious bento archive. Community attention remains minimal, reflected in the low EPSS score of 0.00016, suggesting the vulnerability has not yet gained significant traction among threat actors or researchers.