---
id: "GHSA-rg2m-55pr-vp3q"
kind: "vulnerability"
aliases: ["GHSA-rg2m-55pr-vp3q"]
title: "CVE-2026-119083 - GluonTS arbitrary file write during archive extraction"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "gluonts", "lab-disclosure", "ml-pipelines", "package", "python"]
not_affected_if: ["no-untrusted-archives", "python-3.14-or-later"]
published_at: null
first_seen_at: "2026-11-05T17:07:50+00:00"
updated_at: "2026-11-05T17:08:37+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-171-aws/", "first_seen_at": "2026-11-05T17:07:50+00:00"}]
exploit_sources: []
---

# CVE-2026-119083 - GluonTS arbitrary file write during archive extraction

GluonTS, a Python library for time series modeling, extracts tar archives in a way that follows symbolic and hard links. A crafted archive can make it write arbitrary files outside the intended directory, with the privileges of the extracting process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `pip show gluonts`; versions below `0.17.0` are affected.
- Search your code and pipelines for calls that extract tar archives with GluonTS, especially on archives from untrusted sources.

## Fix

- GluonTS: upgrade to `0.17.0`.

## Timeline

- 2026-11-05T17:07:50+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-171-aws/ — AWS: CVE-2026-119083 - GluonTS arbitrary file write during archive extraction

## Documents

- [advisory] AWS: CVE-2026-119083 - GluonTS arbitrary file write during archive extraction https://aws.amazon.com/security/security-bulletins/rss/2026-171-aws/

## From the sources

CVE-2026-119083 - GluonTS arbitrary file write during archive extraction

### CVE-2026-119083 - GluonTS arbitrary file write during archive extraction

Bulletin ID: 2026-171-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/05/2026 08:30 AM PST

Description:

GluonTS is an open-source Python library for probabilistic time series modeling.

We identified CVE-2026-119083, an issue in the archive extraction utility in GluonTS before 0.17.0. An actor who supplies a crafted tar archive containing symbolic or hard links might be able to write arbitrary files outside the intended extraction directory with the privileges of the extracting process.

Impacted versions: < 0.17.0

Resolution:

This issue has been addressed in gluonts version 0.17.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

If you cannot upgrade immediately, do not use GluonTS to extract tar archives from untrusted or unverified sources. As defense in depth, running on Python 3.14 or later causes TarFile.extractall() to apply the data extraction filter by default, which blocks the link-based traversal described here. Upgrading to 0.17.0 remains the recommended remediation.

References:

- CVE-2026-119083
- GHSA-rg2m-55pr-vp3q

Acknowledgement:

We would like to thank Udit Jain for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_