Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 06:10:14 +0000 CVE-2026-112264 — BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys https://db.gcve.eu/vuln/cve-2026-112264 <p><strong>Affected:</strong> BentoML</p> <p>BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.</p> <p><strong>Affected:</strong> BentoML</p> <p>BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento archive so that bentoml containerize executes injected RUN instructions during docker build, accessing build secrets and poisoning images.</p> https://db.gcve.eu/vuln/cve-2026-112264