GHSA-5r2p-pjr8-7fh7

What it actually does

The SageMaker Python SDK JumpStart search functionality used Python eval() to parse search-related input or metadata. If an attacker can influence the value being parsed, eval() can execute arbitrary Python expressions rather than treating the value as data. In a vulnerable runtime, this can lead to code execution with the privileges of the Python process running the SDK, including access to local files, environment variables, AWS credentials available to the process, and network-accessible resources from that execution context.

Why it matters to the business

Organizations using vulnerable versions of the sagemaker PyPI package may expose machine learning notebooks, pipelines, development workstations, or automation jobs to arbitrary code execution if untrusted or attacker-controlled JumpStart search input is processed. Consequences can include theft of cloud credentials, tampering with ML workflows, data exposure, unauthorized model or artifact access, and disruption of development or training operations. The issue is not listed in CISA KEV and has no reported exploit maturity in the supplied data, but it has been public for 158 days, so remediation should be handled through normal high-priority dependency patching.

How an attack unfolds

An attacker first needs a path to influence data consumed by the SageMaker Python SDK JumpStart search feature, such as through a notebook, script, automation workflow, shared parameter, or service that passes user-supplied search criteria into the vulnerable SDK code. Instead of supplying a benign search expression, the attacker supplies a Python expression designed to execute commands, import modules, read files, exfiltrate environment variables, or launch a follow-on payload. Because the vulnerable code evaluates the expression with eval(), the payload runs inside the Python process. The attacker then uses the privileges and network position of that process to access local artifacts, cloud credentials, model assets, datasets, or external command-and-control infrastructure. Successful exploitation depends heavily on whether untrusted input can reach the JumpStart search parser and what permissions the executing process has.

How to fix it

Upgrade the sagemaker PyPI package to version 3.4.0 or later wherever it is installed. Rebuild notebooks, containers, virtual environments, CI images, and ML workflow images that vendor or pin older sagemaker versions. Regenerate lockfiles after updating dependency constraints. If immediate upgrade is not possible, avoid passing untrusted input into JumpStart search functionality, restrict execution of shared notebooks and automation jobs, run affected workloads with least-privilege IAM roles, and isolate development or training environments from sensitive networks and credentials. Remove any local forks or patches that retain eval()-based parsing.

How to confirm the fix worked

Confirm installed versions with package inventory tooling or commands such as python -m pip show sagemaker and verify the reported version is 3.4.0 or later. Check dependency lockfiles, container manifests, notebook images, and build artifacts for pinned sagemaker versions below 3.4.0. Validate that rebuilt execution environments actually load the patched package by running a Python interpreter in the target environment and checking import sagemaker; sagemaker.__version__. Where source inspection is possible, confirm JumpStart search parsing no longer relies on eval() and uses the patched safe parser. Review applications and notebooks to ensure user-controlled values are not directly passed into JumpStart search without validation.

Typical attack path

1. Identify an application, notebook, CI job, ML workflow, or automation script using a vulnerable sagemaker PyPI package version.
2. Find a way to control or influence input passed to the SageMaker JumpStart search functionality.
3. Craft a malicious Python expression that is valid for eval() and performs an attacker-chosen action.
4. Trigger the vulnerable JumpStart search code path so the SDK evaluates the attacker-controlled expression.
5. Execute commands or Python code with the privileges of the affected Python process.
6. Collect secrets, cloud credentials, model artifacts, datasets, or system information available to that process.
7. Use stolen credentials or network access for lateral movement, persistence, or data exfiltration.

How to detect it

To determine whether exploitation already occurred, review notebook execution history, Python application logs, ML pipeline logs, CI job logs, shell history, audit logs, and cloud activity generated by roles used in SageMaker or ML automation environments. Look for suspicious JumpStart search inputs containing Python execution syntax, imports of os/subprocess/socket, encoded payloads, or shell download commands. Correlate these events with unexpected outbound network connections, new files in temporary directories, unusual child processes spawned by Python, credential access, or anomalous AWS API calls made by the same execution role shortly after the search operation. Inspect notebooks and scripts for saved output cells or parameters containing payload-like strings. If endpoint telemetry is available, hunt for python processes spawning shells or command-line tools such as sh, bash, curl, wget, nc, or powershell. Because no public exploit indicators are supplied, detection should focus on behavioral evidence of Python expression injection and post-exploitation activity rather than a single definitive signature.

• __import__(
• os.system(
• subprocess.Popen(
• subprocess.call(
• subprocess.run(
• eval(
• exec(
• base64.b64decode(
• socket.socket(
• /bin/sh
• /bin/bash
• curl
• wget
• nc -e
• bash -c
• python -c
• python3 -c
• powershell -enc
• sagemaker.jumpstart
• JumpStart search

What your security team should do

• Inventory all uses of the sagemaker PyPI package across notebooks, containers, CI/CD images, ML pipelines, and developer environments.
• Upgrade all affected installations to sagemaker 3.4.0 or later and rebuild dependent runtime images.
• Prioritize environments that process user-supplied search terms, shared notebook parameters, external metadata, or automated JumpStart search workflows.
• Review IAM roles and credentials available to ML development and pipeline runtimes; reduce permissions to least privilege.
• Search notebooks, scripts, logs, and job histories for suspicious Python execution payloads passed near JumpStart search usage.
• Rotate credentials if evidence suggests malicious code ran in a vulnerable environment.
• Add dependency scanning or policy checks to prevent reintroduction of sagemaker versions below 3.4.0.