CVE-2026-100308
HIGH
8,4
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: active
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,8
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory.
To remediate this issue, users should upgrade to version 0.17.0 or later.
470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Other
Potential Impacts:
Execute Unauthorized Code Or Commands
Alter Execution Logic
Dos: Crash, Exit, Or Restart
Other
Read Application Data
Applicable Platforms
Languages:
Java, PHP, Interpreted
502
Deserialization of Untrusted Data
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Other
Potential Impacts:
Modify Application Data
Unexpected State
Dos: Resource Consumption (Cpu)
Varies By Context
Applicable Platforms
Languages:
Java, Ruby, PHP, Python, JavaScript
Technologies:
Not Technology-Specific, ICS/OT, AI/ML
https://aws.amazon.com/security/security-bulletins/2026-119-aws/
https://github.com/awslabs/gluonts/releases/tag/v0.17.0
https://github.com/awslabs/gluonts/security/advisories/GHSA-64q6-5qv7-cwj9