CVE-2026-100308— GluonTS arbitrary command execution during model deserialization
Quick assessment
Affected
AWS gluonts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model di
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100308
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GluonTS arbitrary command execution during model deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory.
To remediate this issue, users should upgrade to version 0.17.0 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100308
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100308
请登录查看更多情报信息。
Other References for CVE-2026-100308 (3)
-
https://aws.amazon.com/security/security-bulletins/2026-119-aws/ vendor-advisory
-
-
https://github.com/awslabs/gluonts/security/advisories/GHSA-64q6-5qv7-cwj9 third-party-advisory
IV. Related Vulnerabilities
Same vendor: AWS
-
CVE-2026-96883
Type confusion in AWS pgcollection allows remote code execut -
CVE-2026-94450
Potential denial of service when configured to send Retry pa -
CVE-2026-92943
Improper validation of certificate with host mismatch in AWS -
CVE-2026-86831
Improper validation of pod identifier uniqueness in aws-netw -
CVE-2026-86830
Incorrect privilege assignment in Temporary Elevated Access
Same weakness: CWE-502
-
CVE-2026-101169
CVE-2026-101169 -
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration -
CVE-2026-82384
Apache Roller: Unauthenticated deserialization in the XML-RP -
CVE-2026-100846
MONAI before 1.5.2 Remote Code Execution via Pickle Deserial -
CVE-2026-100845
MONAI before 1.6.0 Remote Code Execution via NumpyReader
V. Comments for CVE-2026-100308
No comments yet