CVE-2026-100308: Aws Gluonts

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

Affected products

• Aws Gluonts: before 0.17.0 (fixed in 0.17.0)

Published 2026-09-29. Last modified 2026-09-30.