AWS fixes TarSlip path traversal arbitrary file write vulnerability in GluonTS
What happened.Amazon Web Services published security bulletin 2026-171-AWS addressing an arbitrary file write vulnerability during archive extraction in GluonTS.
Why it matters.Automated machine learning pipelines ingest training datasets from public repositories. When extraction libraries permit directory traversal, unvetted dataset archives overwrite local shell scripts and python binaries to achieve remote execution. Machine learning platform engineers should upgrade GluonTS packages to version 0.17.0 across training pipelines. Infrastructure teams should adopt Python 3.14 to enforce native extraction filtering.