A GluonTS archive could write outside its extraction folder

A forecasting job starts with chores such as unpacking its input. That quiet first step is where CVE-2026-119083 sits. On November 5, 2026, AWS disclosed that the archive extraction utility in GluonTS, a Python library for time series modeling, could write outside its intended folder when given a crafted tar archive. An actor needs to get an affected user or application to extract the archive, and any write runs with the extracting process's permissions. [1] [2]

A filename can look local while its destination is elsewhere

A tar archive can carry filesystem entries as well as file contents. A symbolic link points to another path. A hard link gives another name to an existing file. An extractor that accepts either can create a route out of the chosen directory, then write through that route while processing another entry. A name inside a folder is only part of the story. The filesystem also decides where that name leads. [2] [5] [6]

For a hypothetical forecasting team, picture a scheduled job unpacking data delivered by a supplier. Its working directory is disposable, but the process can also write to shared inputs for the next run. If a crafted archive sends a write there, the changed file can outlive the job that unpacked it. The bulletin describes possible writes with that process's permissions. What they could change in a particular environment depends on the permissions and files the worker has. [1] [2]

The library fix shipped before the advisory

The maintainers list versions before 0.17.0 as affected. Release 0.17.0 reached GitHub and the Python Package Index on July 31, 2026. The patched helper checks that entry paths stay within the destination and rejects symbolic and hard links outright. The code explains that ordinary GluonTS archives have no need for those entries. On Python 3.12 or later it also requests Python's data extraction filter explicitly. [2] [3] [4] [5]

AWS recommends upgrading to 0.17.0 or later and carrying the fix into forks. If the library cannot be updated immediately, the vendor says to avoid extracting untrusted or unverified archives with the affected tool. AWS also points out that Python 3.14 and later use the data filter by default, which blocks the link traversal described in the advisory when the default applies. The Python documentation describes limits of the filter, and the library update remains the vendor's recommended fix. [1] [2] [6]

Check the worker that opens the file

The practical question is where extraction happens. A team might upgrade the copy of GluonTS installed in an analyst's notebook while a scheduled forecast still runs from an older image. Or the jobs doing the unpacking and the modeling might have different dependencies entirely. Record the version and runtime on the process that opens the archive and check what else that process can write.

The fix also makes the accepted archive format clearer. A supplier might have a legitimate reason to use links in a general purpose tar file, such as avoiding duplicate copies of a large dataset. The GluonTS helper now rejects those entries. If an ordinary import depends on them, that is a packaging change for the supplier and the receiving team to work through before switching the scheduled job. An archive can pass a transfer checksum and still contain an entry that the extraction policy refuses. [5]

A rollout can use a representative archive from the normal workflow to confirm that a patched worker still accepts the expected data. Treat an interrupted extraction as incomplete, too. Python notes that an extraction can stop with some files already present. Keeping that output separate from data the next job consumes makes a failure easier to handle. [5] [6]

For the example forecast, the useful result is an import that either produces a complete dataset in the work directory or fails without handing partial output to the next run. The fix keeps link entries from redirecting writes. The way the job handles its input, output and permissions determines how far a bad file can travel through the rest of the pipeline. [2] [5] [6]