CVE-2025-27520

BentoML v1.4.2 contains a critical unauthenticated remote code execution flaw caused by insecure deserialization of untrusted data (CWE-502) in the serde.py serialization code. An attacker with network access to a BentoML serving endpoint can send a crafted serialized request payload that the server deserializes unsafely, triggering arbitrary code execution with no credentials or user interaction required. Successful exploitation yields full control of the serving process (confidentiality, integrity and availability all rated high), typically as the account running the model-inference service. Anyone running the affected version — most commonly AI/ML teams exposing BentoML inference APIs, often in containers or cloud environments — is affected. A public security advisory with PoC reference is available (GHSA-33xw-247w-6hmc), EPSS assigns a 40.3% probability of exploitation within 30 days (99th percentile), but the flaw is not yet on the CISA KEV catalog and no confirmed in-the-wild exploitation is reported.

What to do: Upgrade to BentoML 1.4.3 or later immediately (see GHSA-33xw-247w-6hmc for the full advisory). Until patched, restrict network access to BentoML serving endpoints by placing them behind authentication, a reverse proxy, or a private network, and prioritize remediating any instance reachable from the internet. Review process and egress logs on exposed servers for signs of unexpected execution, and monitor closely given the 40.3% EPSS likelihood of exploitation within 30 days.