Bulletin ID: 2026-119-AWSScope: AWSContent Type: Important (requires attention)Publication Date: 09/29/2026 08:00 AM PDTDescription:GluonTS is an open source library for deep learning based time series models. We identified CVE-2026-100308 that allows arbitrary command execution upon deserialization of untrusted model artifacts.Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. The issue arises whenever a user calls Predictor.deserialize() or any RepresentablePredictor.deserialize() on a model directory they do not fully control.Impacted versions: <0.17.0Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.View article