Dashboard / CVE-2026-15035

CVE-2026-15035

LOW
INFO Priority: 0.04 BB Relevance: 29/100
Published: 2026-07-08 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Weakness Classification (3)

Affected Software (1)

VendorProductVersion
bentoml openllm 0.6.30

References & Advisories (7)

https://vuldb.com/cve/CVE-2026-15035
Third Party Advisory VDB Entry
https://vuldb.com/vuln/376786
Third Party Advisory VDB Entry
https://vuldb.com/vuln/376786/cti
Permissions Required
https://vuldb.com/submit/850895
Exploit Third Party Advisory VDB Entry
https://github.com/bentoml/OpenLLM/issues/1229
Exploit Patch Third Party Advisory

Bug Bounty Relevance

29 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

1.9 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

2.22%
Raw Score 0.022200
Percentile 82.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02220
2026-10-28
0.02220

Intelligence Sources

nvd ref →

External Links