MajorCritical vulnerability
CVE-2026-100308 (CVSS 8.4)
NVD · officialPublished Sep 29, 2026Risk 37/100
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.
Technical details
CVSS
8.4
AV:LocalAC:LowPR:NoneUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source