Live › vulnerability › CVE-2026-100308
Go to dashboardGluonTS, AWS's Python library for time series models, runs arbitrary operating system commands when it deserializes a crafted model directory through Predictor.deserialize() or RepresentablePredictor.deserialize(). An attacker who supplies a model artifact gets commands run with the privileges of the process that loads it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Teams that load GluonTS predictors with deserialize() from a model directory they did not create or fully control, such as models downloaded from shared storage, user uploads or third-party sources. Systems that only load models they trained and stored themselves are much less exposed, but the advisory still recommends upgrading.
No product ranges from the sources yet.
pip show gluonts and confirm it is below 0.17.0.Predictor.deserialize( or RepresentablePredictor.deserialize( and check where the model directory comes from.0.17.0 or later with pip install --upgrade gluonts>=0.17.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization
Bulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT
Description:
GluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.
Impacted versions: <0.17.0
Resolution:
This issue has been addressed in GluonTS version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
We recommend users to only deserialize trusted model artifacts using the library.
References:
Acknowledgement:
We would like to thank Michael Holmquist (Hasp Labs) for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns..
This page as .md · .json · in your agent: get_signal("CVE-2026-100308")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.