Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

sagemaker

7 known vulnerabilities (5 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 5 high, 2 medium
Weekly downloads
3.5M
Dependents
50
Registry
PyPI

Advisories 7

  • Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK

    Affected: from 2.199.0, fixed in 2.257.2; from 3.0.0, fixed in 3.8.0; from 2.199.0, fixed in 2.257.2; from 3.0.0, fixed in 3.8.0.

  • Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

    Affected: from 2.199.0, fixed in 2.257.2; from 3.0.0, fixed in 3.8.0; from 2.199.0, fixed in 2.257.2; from 3.0.0, fixed in 3.8.0.

  • CVE-2026-1778Medium 5.9

    TLS disabled by default in select aws/sagemaker-python-sdk configurations

    Affected: fixed in 2.256.0; from 3.0, fixed in 3.1.1; from 3.0, fixed in 3.1.1; fixed in 2.256.0.

  • Cleartext transmission of sensitive materials in aws/sagemaker-python-sdk

    Affected: from 3.0, fixed in 3.2.0; fixed in 2.256.0; fixed in 2.256.0; from 3.0, fixed in 3.2.0.

  • CVE-2025-0508Medium 5.9

    MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk

    Affected: fixed in 2.237.3.

  • Deserialization of Untrusted Data in sagemaker-python-sdk

    Affected: fixed in 2.218.0.

  • Command Injection in sagemaker-python-sdk

    Affected: fixed in 2.214.3.