CVE-2024-9070

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.

• CWE-502

• https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9064The Elementor Inline SVG plugin for WordPress is vulnerable …5.4
• CVE-2024-9065The WP Helper Premium plugin for WordPress is vulnerable to …5.3
• CVE-2024-9066The Marketing and SEO Booster plugin for WordPress is vulner…5.4
• CVE-2024-9067The Youzify – BuddyPress Community, User Profile, Social Net…4.3
• CVE-2024-9068The OneElements – Best Elementor Addons plugin for WordPress…5.4
• CVE-2024-9069The Graphicsly – The ultimate graphics plugin for WordPress …5.4
• CVE-2024-9071The Easy Demo Importer – A Modern One-Click Demo Import Solu…5.4
• CVE-2024-9072The GDPR-Extensions-com – Consent Manager plugin for WordPre…5.4
• CVE-2024-9073The GutenGeek Free Gutenberg Blocks for WordPress plugin for…5.4
• CVE-2024-9074The Advanced Blocks Pro plugin for WordPress is vulnerable t…5.4
• CVE-2024-9075A vulnerability was found in Stirling-Tools Stirling-PDF up …5.4
• CVE-2024-9076A vulnerability was found in DedeCMS up to 5.7.115. It has b…8.8