CVE-2026-119083: 
Python vulnerability analysis and mitigation

CVE-2026-119083 is a path traversal vulnerability in the archive extraction utility of GluonTS, an open-source AWS Python library for probabilistic time series modeling. It affects all GluonTS versions before 0.17.0 and was disclosed on November 5, 2026, through coordinated vulnerability disclosure with researcher Udit Jain. An attacker who can supply a crafted tar archive containing symbolic or hard links may write arbitrary files outside the intended extraction directory with the privileges of the extracting process. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.4 (High) (AWS Security Bulletin, GitHub Advisory).

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-59 (Improper Link Resolution Before File Access), arising because GluonTS's archive extraction utility does not validate or sanitize symbolic or hard links within tar archives before resolving them (GitHub Advisory). The attack vector is local, requiring user interaction — specifically, a user or application must be induced to extract a maliciously crafted tar archive using GluonTS. The underlying Python TarFile.extractall() function, when used without a data extraction filter (the default behavior prior to Python 3.14), does not block link-based traversal, allowing files to be written to arbitrary locations on the filesystem (AWS Security Bulletin). The fix was implemented in pull request #3285 in the GluonTS repository (GluonTS v0.17.0 Release).

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory with the full privileges of the process performing the extraction, resulting in high confidentiality, integrity, and availability impact (GitHub Advisory). This arbitrary file write primitive can be escalated to remote code execution by overwriting executable scripts, configuration files, cron jobs, or SSH authorized keys, potentially enabling full system compromise (AWS Security Bulletin). Environments using GluonTS to process externally supplied datasets or model archives are at greatest risk, particularly automated ML pipelines that extract tar archives without manual review.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable, as it requires active user interaction to trigger extraction of a malicious archive. The EPSS score is 0.0, reflecting low near-term exploitation probability (Feedly Intelligence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious tar archive: Create a tar archive containing a symbolic link or hard link that points to a target path outside the intended extraction directory (e.g., a symlink named payload pointing to /home/user/.ssh/authorized_keys or a cron directory).
2. Include a malicious payload file: Add a file to the archive that, when extracted via the symlink, writes attacker-controlled content to the target path (e.g., an SSH public key or a malicious script).
3. Deliver the archive: Convince a user or automated GluonTS-based pipeline to extract the crafted tar archive — for example, by hosting it as a dataset or model file on a server the victim fetches from, or by supplying it directly.
4. Trigger extraction: The victim application calls GluonTS's archive extraction utility (which internally uses Python's TarFile.extractall() without a data filter), causing the symlink to be followed and the payload written to the attacker-specified path outside the extraction directory.
5. Achieve code execution or persistence: Depending on the target path written, the attacker may gain code execution (e.g., by overwriting a cron job, startup script, or SSH authorized_keys) with the privileges of the extracting process (AWS Security Bulletin, GitHub Advisory).

• File System: Unexpected files written outside the designated GluonTS extraction directory; new or modified files in sensitive locations such as ~/.ssh/authorized_keys, /etc/cron.d/, /etc/cron.daily/, or system startup directories following a tar extraction operation.
• File System: Presence of symbolic or hard links within extracted archive contents pointing to paths outside the extraction directory.
• Logs: Application or system logs showing GluonTS extraction operations on tar archives from external or untrusted sources; Python warnings or errors related to TarFile.extractall() link resolution.
• Process: Unexpected processes spawned with the privileges of the GluonTS service account shortly after archive extraction events.
• Network: Outbound connections from the GluonTS host to unknown external IPs following archive extraction, potentially indicating post-exploitation activity.

The primary remediation is to upgrade GluonTS to version 0.17.0 or later, which includes a fix for path traversal in the archive extraction utility (GluonTS v0.17.0 Release, AWS Security Bulletin). For those unable to upgrade immediately, AWS recommends avoiding extraction of tar archives from untrusted or unverified sources. As an additional defense-in-depth measure, running GluonTS on Python 3.14 or later causes TarFile.extractall() to apply the data extraction filter by default, which blocks the link-based traversal described in this vulnerability. Any forked or derivative code based on GluonTS should also be patched to incorporate the fixes from version 0.17.0 (GitHub Advisory).

AWS published an official security bulletin (2026-171-AWS) acknowledging the issue and crediting researcher Udit Jain for responsible disclosure through coordinated vulnerability disclosure (AWS Security Bulletin). The vulnerability was tracked by Red Hat's Product Security team via Bugzilla and assigned high severity (Red Hat Bugzilla). Coverage appeared in IT security news aggregators and the Mastodon/infosec.exchange security community shortly after disclosure, though no significant researcher commentary or broader media coverage has been identified beyond standard vulnerability tracking.