CVE-2026-15035: bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function asyncruncommand of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15035?
The severity of CVE-2026-15035 is rated as medium with a score of 5.3.
What type of vulnerability is CVE-2026-15035?
CVE-2026-15035 is classified as a command injection vulnerability.
How do I fix CVE-2026-15035?
To fix CVE-2026-15035, ensure proper validation and sanitization of command-line arguments in the async_run_command function.
Who is affected by CVE-2026-15035?
CVE-2026-15035 affects users of BentoML OpenLLM version 0.6.30.
What are the potential impacts of CVE-2026-15035?
CVE-2026-15035 can lead to arbitrary command execution if the command injection is successfully exploited.