CVE-2026-100308

HIGH 7.8

GluonTS arbitrary command execution during model deserialization

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

CWE	CWE-502 CWE-470
Vendor	aws
Product	gluonts
Published	Sep 29, 2026
Last Updated	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for aws gluonts

Be the first to know when new high vulnerabilities affecting aws gluonts are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

AWS / gluonts

0 < 0.17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/awslabs/gluonts/releases/tag/v0.17.0 aws.amazon.com: https://aws.amazon.com/security/security-bulletins/2026-119-aws/ github.com: https://github.com/awslabs/gluonts/security/advisories/GHSA-64q6-5qv7-cwj9

Credits

Hasp Labs