AIKIDO-2026-159223

TL;DR

The gluonts.core.serde module deserializes objects by locating a class from a fully qualified name in the payload and instantiating it. The decode function only rejects a small denylist of builtins (eval, exec, compile, open, input), so a crafted serialized document can name any other importable callable, such as subprocess.run, and have it invoked with attacker-supplied arguments. Loading an untrusted serialized model or predictor through APIs such as Predictor.deserialize therefore results in arbitrary code execution. The fix replaces the denylist with an allowlist that only instantiates types encode is known to produce and rejects any other class.