AmazonAnalysisAWS patches archive extraction file write flaw in GluonTS
What happened.Amazon Web Services published security bulletin 2026-171-AWS detailing an arbitrary file write vulnerability during archive extraction in the open-source GluonTS library.
Why it matters.Machine learning pipelines automatically unpack datasets and pretrained model weights during distributed training runs. When archive extraction routines permit link-based directory traversal, untrusted model files overwrite system binaries and execution hooks. Machine learning engineers should upgrade GluonTS dependencies to version 0.17.0 across training containers. Platform teams must enforce read-only container root filesystems to prevent malicious archive extractions from modifying runtime binaries.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-119083, the flaw occurs when GluonTS processes untrusted tar archive packages containing symbolic or hard link targets.
- Exploitation risk: Applications ingesting machine learning model artifacts or dataset archives can permit attackers to overwrite arbitrary files outside intended extraction directories.
- Affected packages: The vulnerability impacts GluonTS releases prior to version 0.17.0 across time-series forecasting and deep learning modeling pipelines.
- Remediation release: AWS published GluonTS 0.17.0 with strict link sanitization, recommending that machine learning engineers upgrade client and server dependencies.