CVE-2025-27520
Critical · 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
CVSS
9.8
EPSS
40.6%
Published
Apr 4, 2025
CISA due date
—
The record
A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version(v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | bentoml | 1.3.4 | 1.4.3 |
| pypi | bentoml | 1.3.4 | No fix |
Related vulnerabilities
- CVE-2026-27905 BentoML is a Python library for building online serving systems optimized for AI apps and… Also affects bentoml
- GHSA-m6w7-qv66-g3mf BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction Also affects bentoml
- CVE-2026-24123 BentoML is a Python library for building online serving systems optimized for AI apps and… Also affects bentoml
- GHSA-6r62-w2q3-48hf BentoML has a Path Traversal via Bentofile Configuration Also affects bentoml
- CVE-2025-54381 BentoML SSRF Vulnerability in File Upload Processing Also affects bentoml
- CVE-2025-32375 BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure… Also affects bentoml
- CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection… CWE-502
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-502