{"id":"GHSA-64q6-5qv7-cwj9","kind":"vulnerability","aliases":["GHSA-64q6-5qv7-cwj9"],"related":[],"title":"CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization","description":"CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\n### CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\nBulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT\n\nDescription:\n\nGluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.\n\nDeserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.\n\nImpacted versions: <0.17.0\n\nResolution:\n\nThis issue has been addressed in GluonTS version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nWe recommend users to only deserialize trusted model artifacts using the library.\n\nReferences:\n\n- CVE-2026-100308\n- GHSA-64q6-5qv7-cwj9\n\nAcknowledgement:\n\nWe would like to thank Michael Holmquist (Hasp Labs) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","summary":"GluonTS, an open source Python library for deep learning time series models, executes arbitrary operating system commands when a model directory is deserialized through Predictor.deserialize() or RepresentablePredictor.deserialize(). An attacker who supplies a crafted serialized model directory gets commands run with the privileges of the process that loads it.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","gluonts","lab-disclosure","ml-pipelines","package","python"],"not_affected_if":["gluonts-at-or-above-0.17.0","trusted-artifacts-only"],"how_to_check":"- Check the installed version with `pip show gluonts` and treat anything below `0.17.0` as affected.\n- Search code for calls to `Predictor.deserialize(` or `.deserialize(` on GluonTS predictors, especially where the model directory comes from users, uploads, or external storage.","fix":"- Upgrade GluonTS to `0.17.0` or later with `pip install --upgrade gluonts>=0.17.0`.\n- Patch any forked or derivative GluonTS code to include the upstream fixes.\n- Until upgraded, only deserialize model artifacts you trust.","status":"open","published_at":"2026-09-29T00:00:00+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:27:52+00:00","updated_at":"2026-10-25T19:38:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:27:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GluonTS to `0.17.0` or later with `pip install --upgrade gluonts>=0.17.0`.\n- Patch any forked or derivative GluonTS code to include the upstream fixes.\n- Until upgraded, only deserialize model artifacts you trust.","reach":"local","title":"GluonTS: loading an untrusted model directory runs OS commands","impact":"high","summary":"GluonTS, an open source Python library for deep learning time series models, executes arbitrary operating system commands when a model directory is deserialized through Predictor.deserialize() or RepresentablePredictor.deserialize(). An attacker who supplies a crafted serialized model directory gets commands run with the privileges of the process that loads it.","category":"package","nicknames":[],"who_cares":["python","gluonts","ml-pipelines"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs OS commands as the process loading the model","analyst_note":"","how_to_check":"- Check the installed version with `pip show gluonts` and treat anything below `0.17.0` as affected.\n- Search code for calls to `Predictor.deserialize(` or `.deserialize(` on GluonTS predictors, especially where the model directory comes from users, uploads, or external storage.","needs_analyst":false,"not_affected_if":["trusted-artifacts-only","gluonts-at-or-above-0.17.0"],"who_is_affected":"Teams that load GluonTS predictors with deserialize() from a model directory they do not fully control, such as user-supplied models, shared model stores, or artifacts downloaded from outside sources. Systems that only load models they trained and stored themselves are much less exposed, though the sources do not say how likely a tampered artifact is.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":3823,"output_tokens":641,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100308':3A,80C,90C,135C,256C '-119':101C '-2026':2A,79C,89C,134C,255C '..':292C '0.17.0':160C,208C,218C '00':114C '08':113C '09/29/2026':112C '2026':100C '5qv7':14A,19A,260C '64q6':13A,18A,259C 'acknowledg':262C 'address':214C 'allow':137C,162C 'amazon':157C 'arbitrari':5A,44B,82C,92C,138C,169C 'aris':188C 'artifact':146C,249C 'attack':59B,166C 'attent':109C 'aw':21B,102C,104C 'aws-security@amazon.com':285C 'base':127C 'bulletin':98C 'call':192C 'code':232C 'collabor':273C 'command':6A,47B,68B,83C,93C,139C,172C 'compon':155C 'concern':291C 'content':105C 'context':164C 'context-depend':163C 'control':205C 'coordin':279C 'craft':63B,182C 'cve':1A,78C,88C,133C,254C 'cwj9':15A,20A,261C 'data':150C 'date':111C 'deep':38B,125C 'depend':165C 'deriv':231C 'descript':117C 'deseri':10A,53B,87C,97C,142C,147C,246C 'directori':51B,66B,185C,200C 'disclosur':25B,281C 'email':284C 'ensur':227C 'execut':7A,43B,84C,94C,140C,168C 'fix':239C 'fork':229C 'fulli':204C 'get':67B 'ghsa':12A,17A,258C 'ghsa-64q6-5qv7-cwj9':11A,16A,257C 'gluont':4A,22B,31B,81C,91C,118C,158C,216C 'hasp':270C 'holmquist':269C 'id':99C 'identifi':132C 'impact':206C 'import':107C 'incorpor':236C 'issu':187C,211C,276C 'lab':24B,271C 'lab-disclosur':23B 'latest':224C 'learn':39B,126C 'librari':36B,123C,252C 'like':265C 'load':77B,154C,178C 'michael':268C 'might':161C 'ml':27B 'ml-pipelin':26B 'model':9A,42B,50B,65B,86C,96C,130C,145C,153C,184C,199C,248C 'new':238C 'open':33B,121C 'oper':45B,170C 'packag':29B 'patch':234C 'pdt':116C 'pipelin':28B 'pleas':283C 'predictor.deserialize':55B,193C 'privileg':72B,175C 'process':75B,179C,282C 'public':110C 'python':30B,35B 'question':289C 'recommend':220C,242C 'refer':253C 'representablepredictor.deserialize':57B,196C 'requir':108C 'resolut':209C 'run':69B 'scope':103C 'secur':288C 'seri':41B,129C 'serial':64B,183C 'sourc':34B,122C 'suppli':61B 'system':46B,171C 'thank':267C 'time':40B,128C 'trust':247C 'type':106C 'untrust':144C,149C 'upgrad':221C 'upon':141C 'use':250C 'user':191C,243C 'version':207C,217C,225C 'via':180C 'vulner':280C 'whenev':189C 'workaround':240C 'would':264C","nicknames":[],"mitigations":[],"who_affected":"Teams that load GluonTS predictors with deserialize() from a model directory they do not fully control, such as user-supplied models, shared model stores, or artifacts downloaded from outside sources. Systems that only load models they trained and stored themselves are much less exposed, though the sources do not say how likely a tampered artifact is.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/#GHSA-64q6-5qv7-cwj9","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/","severity":null,"published_at":"2026-09-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-25T19:41:07+00:00","note":"AWS: CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization"}],"documents":[{"id":2913,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-119-aws/","title":"AWS: CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization","kind":"advisory","source":"lab","text":"CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\n### CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization\n\nBulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT\n\nDescription:\n\nGluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.\n\nDeserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.\n\nImpacted versions: <0.17.0\n\nResolution:\n\nThis issue has been addressed in GluonTS version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nWe recommend users to only deserialize trusted model artifacts using the library.\n\nReferences:\n\n- CVE-2026-100308\n- GHSA-64q6-5qv7-cwj9\n\nAcknowledgement:\n\nWe would like to thank Michael Holmquist (Hasp Labs) for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns..","published_at":"2026-09-29T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}