Ssjcorpsec

An unsafe deserialization issue exists in the WebDataset reader. An attacker can achieve remote code execution by providing a malicious tar archive to the `read webdataset()` function. The ` default decoder()` function in webdataset datasource.py unconditionally calls `pickle.loads()` on tar entries with .pkl or .pickle extensions and `torch.load()` with `weights only=False` on .pt or .pth entries. This results in the execution of arbitrary code within Ray remote workers on every worker that processes the malicious archive. Deserialization is the process of converting a data format back into an object, which becomes unsafe when untrusted data is processed without validation.

BentoML is a Python library used for building online serving systems optimized for AI applications and model inference. The issue occurs because the template `src/bentoml/ internal/container/frontend/dockerfile/templates/base v2.j2` interpolates the `docker.base image` variable without escaping, newline filtering, or validation. A malicious `bento.yaml` file containing a multi-line value for `docker.base image` can smuggle arbitrary Dockerfile directives into the generated Dockerfile. When the `bentoml containerize` command is executed, it triggers a docker build that runs the injected `RUN` directives on the host system.

BentoML is a Python library used for building online serving systems optimized for AI applications and model inference. A flaw exists where a malicious `bentofile.yaml` file containing a newline-injected value in the `envs[*].name` variable can produce unquoted RUN directives in the generated Dockerfile. When the `bentoml containerize` command is executed on the imported bento, these RUN directives are executed on the host system during the docker build process.