Insecure Deserialization leads to RCE in BentoML's runner server (CVE-2025-32375)
BentoML's runner server was vulnerable to insecure deserialization attacks in versions prior to 1.4.8, allowing attackers to execute arbitrary code and gain access to server information.
What happened
BentoML's runner server contained an insecure deserialization vulnerability affecting versions 1.0 through 1.4.7. By setting specific headers and parameters in a POST request, an attacker could execute arbitrary code on the server.
Reported impact
The vulnerability could grant attackers initial access and information disclosure on the server.
Index analysis
The vulnerability was addressed in BentoML version 1.4.8.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.