CVE-2026-33744: BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Summary

The docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since systempackages is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious bentofile.yaml achieves arbitrary command execution during bentoml containerize / docker build.

Affected Component

- src/bentomlsdk/images.py:85-89 — .format(packages=" ".join(packages)) into shell command - src/bentoml/internal/container/frontend/dockerfile/templates/basedebian.j2:13 — {{ optionssystempackages | join(' ') }} - src/bentoml/internal/bento/buildconfig.py:174 — No validation on systempackages - All distro install commands in src/bentoml/internal/container/frontend/dockerfile/init.py

Affected Versions

All versions supporting docker.systempackages in bentofile.yaml, confirmed on 1.4.36.

Steps to Reproduce

1. Create a project directory with:

service.py: python import bentoml

@bentoml.service class MyService: @bentoml.api def predict(self) -> str: return "hello"

bentofile.yaml: yaml service: "service:MyService" docker: systempackages: - "curl && id > /tmp/bentoml-pwned #"

2. Run: bash bentoml build

3. Examine the generated Dockerfile at ~/bentoml/bentos/myservice/<tag>/env/docker/Dockerfile. Line 41 will contain: dockerfile RUN apt-get install -q -y -o Dpkg::Options::=--force-confdef curl && id > /tmp/bentoml-pwned #

4. Running bentoml containerize myservice:<tag> will execute id > /tmp/bentoml-pwned as root during the Docker build.

Root Cause

The systempackages field values are treated as package names (data) by the user but are string-formatted directly into shell commands in the Dockerfile:

python images.py:85-89 self.commands.append( CONTAINERMETADATA[self.distro]["installcommand"].format( packages=" ".join(packages) # No escaping ) )

Where installcommand is "apt-get install -q -y -o Dpkg::Options::=--force-confdef {packages}".

A bashquote filter (wrapping shlex.quote) exists in the codebase and is registered in both Jinja2 environments, but it is only applied to environment variable values, never to systempackages.

Impact

1. Malicious repositories: An attacker publishes an ML project with a crafted bentofile.yaml. Anyone who clones and builds it gets arbitrary code execution during docker build. 2. CI/CD compromise: Automated pipelines running bentoml containerize on PRs that modify bentofile.yaml are vulnerable. 3. BentoCloud: If BentoCloud builds images from user-supplied bentofile.yaml, this could achieve RCE on cloud infrastructure. 4. Supply chain: Shared bentos or model repos in the BentoML ecosystem can contain malicious configs.

Suggested Fix

Option 1: Input validation (recommended)

Add a regex validator to systempackages in buildconfig.py:

python import re

VALIDPACKAGENAME = re.compile(r'^[a-zA-Z0-9][a-zA-Z0-9.+\-:]$')

def validatesystempackages(instance, attribute, value): if value is None: return for pkg in value: if not VALIDPACKAGENAME.match(pkg): raise BentoMLException( f"Invalid system package name: {pkg!r}. " "Package names may only contain alphanumeric characters, " "dots, plus signs, hyphens, underscores, and colons." )

systempackages: t.Optional[t.List[str]] = attr.field( default=None, validator=validatesystempackages )

Option 2: Output escaping

Apply shlex.quote() to each package name before interpolation in images.py:systempackages() and apply the bashquote Jinja2 filter in basedebian.j2.