CVE-2025-27520 in the critical feed json
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
published 2025-04-04 19 mo ago modified 2026-10-27 13 d ago also EUVD-2025-9752 , GHSA-33xw-247w-6hmc , PYSEC-2026-294
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 40.6%
- EPSS 40.6% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit
Summary
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
Patch / fix
Timeline
- First public exploit (Metasploit exploit/linux/http/bentoml_rce_cve_2025_27520)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
40.62% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/bentoml_rce_cve_2025_27520 BentoML RCE metasploit exploit, excellent rank, 2025-04-04
- github.com https://github.com/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | bentoml | >=1.3.4, <1.4.3 |
1.4.3 |
Affected products
- bentoml BentoML
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/bentoml/BentoML/commit/b35f4f4fcc53a8c3fe8ed9c18a013fe0a728e194
web, patch
-
github.com
/bentoml/BentoML/security/advisories/GHSA-33xw-247w-6hmc
exploit, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-27520
advisory
-
github.com
/bentoml/BentoML
package
-
github.com
/pypa/advisory-database/tree/main/vulns/bentoml/PYSEC-2026-294.yaml
web
-
pypi.org
/project/bentoml
web, package
-
github.com
/advisories/GHSA-33xw-247w-6hmc
advisory
Sources
- CVE List CVE-2025-27520
- GitHub Advisory GHSA-33xw-247w-6hmc
- NVD CVE-2025-27520
- OSV PYSEC-2026-294
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.