CVE-2026-119083

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. T...

CVE-2026-119083 GluonTS arbitrary file write during archive extraction

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. T...

CVE-2026-119083

Versions of GluonTS prior to 0.17.0 are vulnerable to a path traversal vulnerability in the archive extraction utility. An attacker providing a crafted tar archive can use symbolic or hard links to write arbitrary files outside the intended extraction directory, executing with the privileges of t...

EUVD-2026-117593

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. T...

CVE-2026-100308

A flaw was found in GluonTS. The model loading component fails to safely handle untrusted data during deserialization, which can allow an attacker to execute arbitrary commands with the privileges of the running process. An attacker can exploit this issue by convincing a user or system to load a...

CVE-2026-100308

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

EUVD-2026-88979

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

analysis3054 (>=0.3.24, <=0.5.2), autogluon (>=0.5.0b20220623, <=1.5.1b20260720) +18 more potentially affected by CVE-2026-100308 via gluonts (>=0.6.0, <=0.17.0rc1)

gluonts PYPI version =0.6.0, =0.3.24, =0.5.0b20220623, =0.5.0b20220623, =0.1.3, =0.0.1, =0.6.0, =1.0.0, =0.2.0, =0.1.3, =0.0.1, =0.1.0 and more Source cves: CVE-2026-100308 Source advisory: MEND:CVE-2026-100308...

CVE-2026-100308

The Amazon GluonTS library is vulnerable to arbitrary command execution in versions prior to 0.17.0 . The root cause is the deserialization of untrusted data within the model loading component, which may allow context-dependent attackers to execute OS commands with the privileges of the loading p...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

CVE-2026-100308 GluonTS arbitrary command execution during model deserialization

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

PT-2026-102633

Name of the Vulnerable Software and Affected Versions Amazon GluonTS versions prior to 0.17.0 Description Deserialization of untrusted data in the model loading component allows context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process b...

CVE-2026-100308: Deserialization of Untrusted Data

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, use...

asynql (0.1.0), botx (>=0.11.0, <=0.11.3) +2 more potentially affected by CVE-2024-3772 via pydantic (0.28.0)

pydantic PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - asynql 0.1.0 - botx =0.11.0, =0.30.0, =0.1.4, =0.4.1 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

gluonts (>=0.1.1, <=0.1.3), sbus (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-3772 via pydantic (0.12.1)

pydantic PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - gluonts =0.1.1, =0.2.0, =0.2.5 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

asynql (0.1.0), botx (>=0.11.0, <=0.11.3) +2 more potentially affected by CVE-2024-3772 via pydantic (0.28.0)

pydantic PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - asynql 0.1.0 - botx =0.11.0, =0.30.0, =0.1.4, =0.4.1 Source cves: CVE-2024-3772 Source advisory: OSV:GHSA-MR82-8J83-VXMV...

gluonts (>=0.1.1, <=0.1.3), sbus (>=0.2.0, <=0.2.5) potentially affected by CVE-2024-3772 via pydantic (0.12.1)

pydantic PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - gluonts =0.1.1, =0.2.0, =0.2.5 Source cves: CVE-2024-3772 Source advisory: OSV:GHSA-MR82-8J83-VXMV...

gluonts (>=0.1.1, <=0.1.3), sbus (>=0.2.0, <=0.2.5) potentially affected by CVE-2021-29510 via pydantic (0.12.1)

pydantic PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - gluonts =0.1.1, =0.2.0, =0.2.5 Source cves: CVE-2021-29510 Source advisory: OSV:GHSA-5JQP-QGF6-3PVH...