CVE-2024-9070
Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml
A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
Reserved 2024-09-20 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5
Support options
