CVE-2026-100308

Published: Sep 29, 2026Modified: Sep 30, 2026

8.4

Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5 (Secondary)

Description

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

Related CWEs

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://aws.amazon.com/security/security-bulletins/2026-119-aws/

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/awslabs/gluonts/releases/tag/v0.17.0

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

https://github.com/awslabs/gluonts/security/advisories/GHSA-64q6-5qv7-cwj9

Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

Timeline

No history available yet.