{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.6.30"}],"component":"bentoml","cve_ids":["CVE-2026-15035"],"ecosystem":"PyPI","epss":0.0222,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGXDCVX1D744XWD2M1A501","modified_at":"2026-07-10T11:30:05.951427430Z","published_at":"2026-07-08T14:16:56.643Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2089","https://github.com/bentoml/OpenLLM/","https://vuldb.com/cve/CVE-2026-15035","https://vuldb.com/vuln/376786","https://vuldb.com/vuln/376786/cti","https://github.com/bentoml/OpenLLM/issues/1229","https://github.com/bentoml/OpenLLM/pull/1235","https://vuldb.com/submit/850895"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2089","url":"https://osv.dev/vulnerability/PYSEC-2026-2089"}],"summary":"A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing"}