{"action":"Upgrade bentoml to 1.4.19 or later.","affected":[{"fixed":"1.4.19","introduced":"1.4.0"}],"component":"bentoml","cve_ids":["CVE-2025-54381"],"ecosystem":"PyPI","epss":0.16152,"exploited":false,"fixed_versions":["1.4.19"],"ghsa_id":"GHSA-mrmq-3q62-6cc8","id":"tcs_01M5KH2N2F9R9Z25G166Y3KC1D","modified_at":"2026-07-01T20:22:49.858115Z","published_at":"2026-06-29T11:50:37.216989Z","references":["https://osv.dev/vulnerability/PYSEC-2026-297","https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8","https://nvd.nist.gov/vuln/detail/CVE-2025-54381","https://github.com/bentoml/BentoML/commit/534c3584621da4ab954bdc3d814cc66b95ae5fb8","https://github.com/bentoml/BentoML","https://pypi.org/project/bentoml","https://github.com/advisories/GHSA-mrmq-3q62-6cc8"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-297","url":"https://osv.dev/vulnerability/PYSEC-2026-297"}],"summary":"BentoML SSRF Vulnerability in File Upload Processing"}