CVE-2026-100308
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.
- Published Sep 29, 2026
- CVSS 8.4 high
- 0.1% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- CVE-2026-100308 - GluonTS arbitrary command execution during model deserialization AWS Security Bulletins ·