GHSA-rg2m-55pr-vp3q · Package
NO FIX YET · SEE WHAT TO DO
GluonTS, a Python library for time series modeling, extracts tar archives in a way that follows symbolic and hard links. A crafted archive can make it write arbitrary files outside the intended directory, with the privileges of the extracting process.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that use GluonTS to extract tar archives from sources they do not fully trust. Risk depends on whether the process running extraction has write access to sensitive paths. Teams that do not extract archives with GluonTS, or that run only on trusted data, are less exposed. Running on Python 3.14 or later applies the tar data extraction filter by default, which blocks this link-based traversal, according to the bulletin.
Not affected if no-untrusted-archives, python-3.14-or-later
Who cares aws, gluonts, lab-disclosure, ml-pipelines, python
pip show gluonts; versions below 0.17.0 are affected.0.17.0.CVE-2026-119083 - GluonTS arbitrary file write during archive extraction
Bulletin ID: 2026-171-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/05/2026 08:30 AM PST
Description:
GluonTS is an open-source Python library for probabilistic time series modeling.
We identified CVE-2026-119083, an issue in the archive extraction utility in GluonTS before 0.17.0. An actor who supplies a crafted tar archive containing symbolic or hard links might be able to write arbitrary files outside the intended extraction directory with the privileges of the extracting process.
Impacted versions: < 0.17.0
Resolution:
This issue has been addressed in gluonts version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
If you cannot upgrade immediately, do not use GluonTS to extract tar archives from untrusted or unverified sources. As defense in depth, running on Python 3.14 or later causes TarFile.extractall() to apply the data extraction filter by default, which blocks the link-based traversal described here. Upgrading to 0.17.0 remains the recommended remediation.
References:
Acknowledgement:
We would like to thank Udit Jain for collaborating on this issue through the coordinated vulnerability disclosure process.
Please email aws-security@amazon.com with any security questions or concerns.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.