CVE-2026-44346

Description

Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/bentoml/BentoML/security/advisories/GHSA-w2pm-x38x-jp44
• https://github.com/bentoml/BentoML/security/advisories/GHSA-78f9-r8mh-4xm2
• https://github.com/bentoml/BentoML
• https://github.com/advisories/GHSA-w2pm-x38x-jp44

CWEs

CWE-78 CWE-94