CVE-2026-108597: Cohere tar slip — MEDIUM

CISO Take

The Cohere Python SDK (5.11.0 through 7.2.0) extracts model archives from S3 with an unvalidated tarfile.extractall call in its SageMaker helper, so a malicious archive with absolute paths or ../ members can overwrite arbitrary files on the machine running the SDK. Exploitation is hard: the attacker must already be able to write to the victim's S3 prefix, and a user or pipeline must trigger the download and extraction. That is why it is rated medium (CVSS 4.8). There is no EPSS data, no CISA KEV listing, no public exploit and no Nuclei template, but the write primitive can become code execution if it lands on startup scripts, cron entries or Python site-packages. Upgrade to a patched Cohere SDK release once the vendor's fix is confirmed, and until then audit who has write access to the S3 buckets and prefixes used for SageMaker model artifacts. Treat any workflow that pulls tarballs from shared or cross-account storage as untrusted input.

Sources:NVDATLASvulncheck.comgithub.com/cohere-ai/cohere-python

What is the risk?

Medium overall. The CVSS vector (AV:N/AC:H/PR:L/UI:R) reflects the preconditions: the attacker needs write access to the victim's S3 prefix, and a legitimate user or job must run the SageMaker model-directory-to-tarfile code path. Impact is limited to integrity (I:H). Arbitrary file write on a developer workstation, CI runner or ML pipeline host can escalate to code execution, so real-world risk is higher where S3 permissions are loose or buckets are shared across teams or accounts. No exploitation in the wild, EPSS score, public exploit or scanner template was found in the provided data, and the downstream dependent count is unknown.

How does the attack unfold?

Initial Access

Attacker with write access to the victim's S3 prefix uploads a crafted model tarball containing ../ or absolute-path members.

AML.T0010.003

Execution

A user or pipeline runs the Cohere SDK SageMaker helper, which calls tarfile.extractall without validating member paths.

AML.T0011.000

Exploitation

Archive members are written outside the intended directory, overwriting files such as shell profiles, SSH keys or Python modules on the SDK host.

Impact

Overwritten files give persistence or code execution, enabling credential theft and tampering with models and deployments.

Initial Access

Attacker with write access to the victim's S3 prefix uploads a crafted model tarball containing ../ or absolute-path members.

AML.T0010.003

Execution

A user or pipeline runs the Cohere SDK SageMaker helper, which calls tarfile.extractall without validating member paths.

AML.T0011.000

Exploitation

Archive members are written outside the intended directory, overwriting files such as shell profiles, SSH keys or Python modules on the SDK host.

Impact

Overwritten files give persistence or code execution, enabling credential theft and tampering with models and deployments.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cohere	pip	—	No patch
406OpenSSF 4.6377 dependentsPushed 10d ago11% patched~14d to patchFull package profile →

Do you use Cohere? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UIRequired

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade the cohere package to a release newer than 7.2.0 that contains the fix, after confirming the fixed version in the vendor repository or the VulnCheck advisory. 2) Until patched, avoid the SageMaker model-directory extraction helper, or run it only against buckets and prefixes you fully control. 3) Restrict S3 write permissions (least-privilege IAM, bucket policies, no public or cross-account write access) on model artifact prefixes, and enable object versioning and CloudTrail data events. 4) Run SDK workflows as a low-privilege user in an ephemeral container or sandbox with a read-only filesystem outside the working directory. 5) Detect: inventory cohere versions in 5.11.0-7.2.0 with SCA or pip freeze, review S3 archives for members with absolute paths or '..' segments (tar -tf), and monitor for unexpected file writes outside the intended extraction directory.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionFrameworkAPIAML.T0010.001- AI Software AML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-108597?

The Cohere Python SDK (5.11.0 through 7.2.0) extracts model archives from S3 with an unvalidated tarfile.extractall call in its SageMaker helper, so a malicious archive with absolute paths or ../ members can overwrite arbitrary files on the machine running the SDK. Exploitation is hard: the attacker must already be able to write to the victim's S3 prefix, and a user or pipeline must trigger the download and extraction. That is why it is rated medium (CVSS 4.8). There is no EPSS data, no CISA KEV listing, no public exploit and no Nuclei template, but the write primitive can become code execution if it lands on startup scripts, cron entries or Python site-packages. Upgrade to a patched Cohere SDK release once the vendor's fix is confirmed, and until then audit who has write access to the S3 buckets and prefixes used for SageMaker model artifacts. Treat any workflow that pulls tarballs from shared or cross-account storage as untrusted input.

Is CVE-2026-108597 actively exploited?

No confirmed active exploitation of CVE-2026-108597 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108597?

1) Upgrade the cohere package to a release newer than 7.2.0 that contains the fix, after confirming the fixed version in the vendor repository or the VulnCheck advisory. 2) Until patched, avoid the SageMaker model-directory extraction helper, or run it only against buckets and prefixes you fully control. 3) Restrict S3 write permissions (least-privilege IAM, bucket policies, no public or cross-account write access) on model artifact prefixes, and enable object versioning and CloudTrail data events. 4) Run SDK workflows as a low-privilege user in an ephemeral container or sandbox with a read-only filesystem outside the working directory. 5) Detect: inventory cohere versions in 5.11.0-7.2.0 with SCA or pip freeze, review S3 archives for members with absolute paths or '..' segments (tar -tf), and monitor for unexpected file writes outside the intended extraction directory.

What systems are affected by CVE-2026-108597?

This vulnerability affects the following AI/ML architecture patterns: Training pipelines, Model deployment pipelines, Cloud ML platforms (AWS SageMaker), MLOps CI/CD automation, LLM API client environments.

What is the CVSS score for CVE-2026-108597?

CVE-2026-108597 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

Training pipelinesModel deployment pipelinesCloud ML platforms (AWS SageMaker)MLOps CI/CD automationLLM API client environments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.

Exploitation Scenario

An attacker with write access to an S3 prefix used for SageMaker model artifacts, for example through a leaked low-privilege credential or an over-permissive bucket policy, uploads a tarball containing a member named ../../.ssh/authorized_keys or an absolute path to a Python startup file. A data scientist or automated MLOps pipeline using the Cohere SDK's SageMaker helper runs the model download and extraction step. The unvalidated extractall writes the attacker's files outside the target directory, giving the attacker persistent access or code execution on the host. From there they can steal cloud credentials and tamper with models or deployments.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.