{"id":"CVE-2026-100308","kind":"vulnerability","aliases":["CVE-2026-100308"],"related":[],"title":"GluonTS: loading an untrusted model directory runs OS commands","description":"CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\n### CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\nBulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT\n\nDescription:\n\nGluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.\n\nDeserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.\n\nImpacted versions: <0.17.0\n\nResolution:\n\nThis issue has been addressed in GluonTS version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nWe recommend users to only deserialize trusted model artifacts using the library.\n\nReferences:\n\n- CVE-2026-100308\n- GHSA-64q6-5qv7-cwj9\n\nAcknowledgement:\n\nWe would like to thank Michael Holmquist (Hasp Labs) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","summary":"GluonTS, AWS's Python library for time series models, runs arbitrary operating system commands when it deserializes a crafted model directory through Predictor.deserialize() or RepresentablePredictor.deserialize(). An attacker who supplies a model artifact gets commands run with the privileges of the process that loads it.","severity":"high","cvss":8.4,"epss":0.00136,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","gluonts","lab-disclosure","ml-pipelines","package","python"],"not_affected_if":["gluonts-0.17.0-or-later","trusted-artifacts-only"],"how_to_check":"- Check the installed version with `pip show gluonts` and confirm it is below `0.17.0`.\n- Search code for calls to `Predictor.deserialize(` or `RepresentablePredictor.deserialize(` and check where the model directory comes from.","fix":"- Upgrade GluonTS to `0.17.0` or later with `pip install --upgrade gluonts>=0.17.0`.\n- Patch any forked or derivative copy of GluonTS code, as AWS recommends.\n- Until upgraded, only deserialize model artifacts you fully control.","status":"open","published_at":"2026-09-29T00:00:00+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T03:01:59+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:01:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GluonTS to `0.17.0` or later with `pip install --upgrade gluonts>=0.17.0`.\n- Patch any forked or derivative copy of GluonTS code, as AWS recommends.\n- Until upgraded, only deserialize model artifacts you fully control.","reach":"unknown","title":"GluonTS: loading an untrusted model directory runs OS commands","impact":"high","summary":"GluonTS, AWS's Python library for time series models, runs arbitrary operating system commands when it deserializes a crafted model directory through Predictor.deserialize() or RepresentablePredictor.deserialize(). An attacker who supplies a model artifact gets commands run with the privileges of the process that loads it.","category":"package","nicknames":[],"who_cares":["python","gluonts","ml-pipelines"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands as the model-loading process","analyst_note":"","how_to_check":"- Check the installed version with `pip show gluonts` and confirm it is below `0.17.0`.\n- Search code for calls to `Predictor.deserialize(` or `RepresentablePredictor.deserialize(` and check where the model directory comes from.","needs_analyst":false,"not_affected_if":["trusted-artifacts-only","gluonts-0.17.0-or-later"],"who_is_affected":"Teams that load GluonTS predictors with deserialize() from a model directory they did not create or fully control, such as models downloaded from shared storage, user uploads or third-party sources. Systems that only load models they trained and stored themselves are much less exposed, but the advisory still recommends upgrading.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":3854,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100308':12A,15A,71C,81C,126C,247C '-119':92C '-2026':11A,14A,70C,80C,125C,246C '..':283C '0.17.0':151C,199C,209C '00':105C '08':104C '09/29/2026':103C '2026':91C '5qv7':251C '64q6':250C 'acknowledg':253C 'address':205C 'allow':128C,153C 'amazon':148C 'arbitrari':36B,73C,83C,129C,160C 'aris':179C 'artifact':57B,137C,240C 'attack':52B,157C 'attent':100C 'aw':16B,27B,93C,95C 'aws-security@amazon.com':276C 'base':118C 'bulletin':89C 'call':183C 'code':223C 'collabor':264C 'command':9A,39B,59B,74C,84C,130C,163C 'compon':146C 'concern':282C 'content':96C 'context':155C 'context-depend':154C 'control':196C 'coordin':270C 'craft':44B,173C 'cve':10A,13A,69C,79C,124C,245C 'cwj9':252C 'data':141C 'date':102C 'deep':116C 'depend':156C 'deriv':222C 'descript':108C 'deseri':42B,78C,88C,133C,138C,237C 'directori':6A,46B,176C,191C 'disclosur':20B,272C 'email':275C 'ensur':218C 'execut':75C,85C,131C,159C 'fix':230C 'fork':220C 'fulli':195C 'get':58B 'ghsa':249C 'ghsa-64q6-5qv7-cwj9':248C 'gluont':1A,17B,26B,72C,82C,109C,149C,207C 'hasp':261C 'holmquist':260C 'id':90C 'identifi':123C 'impact':197C 'import':98C 'incorpor':227C 'issu':178C,202C,267C 'lab':19B,262C 'lab-disclosur':18B 'latest':215C 'learn':117C 'librari':30B,114C,243C 'like':256C 'load':2A,68B,145C,169C 'michael':259C 'might':152C 'ml':22B 'ml-pipelin':21B 'model':5A,34B,45B,56B,77C,87C,121C,136C,144C,175C,190C,239C 'new':229C 'open':112C 'oper':37B,161C 'os':8A 'packag':24B 'patch':225C 'pdt':107C 'pipelin':23B 'pleas':274C 'predictor.deserialize':48B,184C 'privileg':63B,166C 'process':66B,170C,273C 'public':101C 'python':25B,29B 'question':280C 'recommend':211C,233C 'refer':244C 'representablepredictor.deserialize':50B,187C 'requir':99C 'resolut':200C 'run':7A,35B,60B 'scope':94C 'secur':279C 'seri':33B,120C 'serial':174C 'sourc':113C 'suppli':54B 'system':38B,162C 'thank':258C 'time':32B,119C 'trust':238C 'type':97C 'untrust':4A,135C,140C 'upgrad':212C 'upon':132C 'use':241C 'user':182C,234C 'version':198C,208C,216C 'via':171C 'vulner':271C 'whenev':180C 'workaround':231C 'would':255C","nicknames":[],"mitigations":[],"who_affected":"Teams that load GluonTS predictors with deserialize() from a model directory they did not create or fully control, such as models downloaded from shared storage, user uploads or third-party sources. Systems that only load models they trained and stored themselves are much less exposed, but the advisory still recommends upgrading.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-29T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/#CVE-2026-100308","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/","severity":null,"published_at":"2026-09-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"AWS: CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization"},{"source":"nvd","external_id":"CVE-2026-100308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100308","severity":null,"published_at":"2026-09-29T16:17:04+00:00","modified_at":"2026-09-30T16:16:59+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-100308","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100308","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2913,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/","title":"AWS: CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization","kind":"advisory","source":"lab","text":"CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\n### CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\nBulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT\n\nDescription:\n\nGluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.\n\nDeserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.\n\nImpacted versions: <0.17.0\n\nResolution:\n\nThis issue has been addressed in GluonTS version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nWe recommend users to only deserialize trusted model artifacts using the library.\n\nReferences:\n\n- CVE-2026-100308\n- GHSA-64q6-5qv7-cwj9\n\nAcknowledgement:\n\nWe would like to thank Michael Holmquist (Hasp Labs) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","published_at":"2026-09-29T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}