CVE-2026-108597: Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hosts using Cohere Python SDK versions 5.11.0 through 7.2.0 are exposed when they process model archives from an S3 prefix that an attacker can write to. The vulnerable extraction occurs in the SageMaker-related model archive handling path.
What does an attacker need to exploit it?
An attacker needs the ability to place or modify a model archive in the S3 prefix used by the victim. The archive must contain tar members with absolute paths or ../ path traversal sequences, and the victim host must extract it through the affected SDK functionality.
What could exploitation do?
Exploitation can cause arbitrary file writes on the host running the SDK by overwriting files outside the intended extraction directory. The provided data identifies integrity impact, but does not establish confidentiality or availability impact.
What can be done before patching is available?
Prevent untrusted parties from writing model archives to the S3 prefix consumed by the SDK. Treat archives in that location as trusted inputs and restrict write permissions accordingly.