AmazonAnalysisAWS fixes TarSlip path traversal arbitrary file write vulnerability in GluonTS
What happened.Amazon Web Services published security bulletin 2026-171-AWS addressing an arbitrary file write vulnerability during archive extraction in GluonTS.
Why it matters.Automated machine learning pipelines ingest training datasets from public repositories. When extraction libraries permit directory traversal, unvetted dataset archives overwrite local shell scripts and python binaries to achieve remote execution. Machine learning platform engineers should upgrade GluonTS packages to version 0.17.0 across training pipelines. Infrastructure teams should adopt Python 3.14 to enforce native extraction filtering.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-119083, the defect involves a TarSlip directory traversal flaw during automated dataset archive unpacking.
- Exploit mechanics: Crafted tar archives containing malicious links write files outside the designated extraction directory with process privileges.
- Ecosystem impact: The flaw impacts GluonTS versions prior to 0.17.0 across Python pipelines running probabilistic time-series forecasting.
- Remediation release: AWS released GluonTS version 0.17.0 with secure archive extraction filters that restrict writes to target directories.
- Runtime defense: AWS noted that running data pipelines under Python 3.14 or later applies default TarFile extraction filters that neutralize symlink traversals.