CyberRota Analysis
AI-GeneratedA command injection vulnerability exists in the async_run_command function of the Model Repository Directory Name Handler in bentoml OpenLLM version 0.6.30, allowing an attacker to manipulate the cmd argument. This flaw requires local access to exploit and could lead to unauthorized command execution. Organizations using this version should prioritize remediation, especially those with local access to the affected systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Related CVEs
Other vulnerabilities affecting the same vendor(s)