---
id: CVE-2024-2912
aliases:
  - GHSA-hvj5-mvw9-93j3
  - PYSEC-2026-296
title: Insecure deserialization in BentoML
summary: Insecure deserialization in BentoML
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: bentoml
product: bentoml
ecosystem: pip
affected:
  - bentoml < 1.2.5
patched:
  - bentoml 1.2.5
published: '2024-04-16'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T15:30:04.261964825Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hvj5-mvw9-93j3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-2912'
  - url: >-
      https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b
  - url: 'https://github.com/bentoml/BentoML'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/bentoml/PYSEC-2026-296.yaml
  - url: 'https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68'
  - url: 'https://pypi.org/project/bentoml'
  - url: 'https://github.com/advisories/GHSA-hvj5-mvw9-93j3'
tags:
  - osv
  - pip
  - ghsa
epss: 0.01509
epssPercentile: 0.74291
cwe:
  - CWE-1188
ingestedAt: '2026-10-27T16:11:58.733Z'
---

## Overview

An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.

## Affected packages

- `bentoml < 1.2.5`

## Remediation

Upgrade to a patched release:

- `bentoml 1.2.5`