---
id: "CVE-2026-100308"
kind: "vulnerability"
aliases: ["CVE-2026-100308"]
title: "GluonTS: loading an untrusted model directory runs OS commands"
severity: "high"
cvss: 8.4
epss: 0.00136
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "gluonts", "lab-disclosure", "ml-pipelines", "package", "python"]
not_affected_if: ["gluonts-0.17.0-or-later", "trusted-artifacts-only"]
published_at: "2026-09-29T00:00:00+00:00"
first_seen_at: "2026-10-24T18:56:54+00:00"
updated_at: "2026-10-25T19:38:19+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/", "first_seen_at": "2026-10-24T18:56:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100308", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-100308", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# GluonTS: loading an untrusted model directory runs OS commands

GluonTS, AWS's Python library for time series models, runs arbitrary operating system commands when it deserializes a crafted model directory through Predictor.deserialize() or RepresentablePredictor.deserialize(). An attacker who supplies a model artifact gets commands run with the privileges of the process that loads it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show gluonts` and confirm it is below `0.17.0`.
- Search code for calls to `Predictor.deserialize(` or `RepresentablePredictor.deserialize(` and check where the model directory comes from.

## Fix

- Upgrade GluonTS to `0.17.0` or later with `pip install --upgrade gluonts>=0.17.0`.
- Patch any forked or derivative copy of GluonTS code, as AWS recommends.
- Until upgraded, only deserialize model artifacts you fully control.

## Mitigated for you by

- Team (workaround): covers Loading model directories from sources the team fully controls, so crafted serialized model directories are not deserialized Limits: none stated; relies on the team's ability to verify that artifacts are trusted and does not address untrusted inputs Still: Only deserialize trusted model artifacts with the library until upgrading to GluonTS 0.17.0 https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/

## Timeline

- 2026-10-24T18:56:54+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/ — AWS: CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization
- 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100308
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-100308

## Documents

- [advisory] AWS: CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/

## From the sources

CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization

### CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization

Bulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT

Description:

GluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.

Impacted versions: <0.17.0

Resolution:

This issue has been addressed in GluonTS version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

We recommend users to only deserialize trusted model artifacts using the library.

References:

- CVE-2026-100308
- GHSA-64q6-5qv7-cwj9

Acknowledgement:

We would like to thank Michael Holmquist (Hasp Labs) for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns..

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_