A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| bentoml(PyPI) | 0 | N/A | N/A |
CVSS Metrics
