Attributed metadata history
Up to 100 retained publisher events per page for 6bc49b5df054fc4dc758caf6877993173c5dfdb7d3cccd61b95d58894fba6b9d. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:03 UTC
Bulletin ID: 2026-119-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/29/2026 08:00 AM PDT Description: GluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts. Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control. Impacted versions: <0.17.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. View article
Fingerprint: e5e59e6c75a232788d2737998a10c980d5e1616eeea00b7a974ec828b0501eb1
intelligence_src_b35573840dfc5ce6da
observed · 2026-10-12 14:29:02 UTC
available
Fingerprint: 596c214e60f67af37a9e8175e4f5cd1a8ccaa6da5d5c0b2911f426d14b9208a6