CVE-2026-100308 — GluonTS arbitrary command execution during model deserialization
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system co…
Published: 2026-09-29 · CVSS: 8.4 · CVSS 4.0
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7