PT-2026-102633 · Amazon · Gluonts

Hasp Labs

·

CVE-2026-100308

·

Published

2026-09-29

·

Updated

2026-09-29

CVSS v4.0

8.4

High

VectorAV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Amazon GluonTS versions prior to 0.17.0
Description Deserialization of untrusted data in the model loading component allows context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process by using a crafted serialized model directory.
Recommendations Upgrade to version 0.17.0 or later.

Exploit

Fix

Deserialization of Untrusted Data

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-470CWE-502

Related Identifiers

CVE-2026-100308
GHSA-64Q6-5QV7-CWJ9

Affected Products

Gluonts