Is CVE-2026-100308 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100308?

CVE-2026-100308 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-100308

Description

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.