cve.bz

CVE-2025-27520

9.8 criticalEPSS 41%

Critical (9.8) in bentoml bentoml. EPSS 41% chance of exploitation in the next 30 days. Fixed in bentoml 1.4.3.

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
41% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-33xw-247w-6hmcPyPIbentoml>=1.3.4 <1.4.31.4.3
PYSEC-2026-294PyPIbentoml>=1.3.4 <1.4.31.4.3

References

Check your stackJSON