CVE-2026-108597 in Python SDK
Summary
by MITRE • 10/10/2026
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The Cohere Python SDK versions 5.11.0 through 7.2.0 contain a critical path traversal vulnerability within the _s3_models_dir_to_tarfile function, which facilitates arbitrary file writes on the host system executing the code. This flaw stems from an improper validation of archive member paths prior to extraction, specifically involving the use of tarfile.extractall without adequate safeguards against maliciously crafted archives. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it allows attackers to escape the intended directory structure and write files to arbitrary locations on the filesystem.
The technical mechanism of this exploit relies on the behavior of Python's tarfile module when handling archive members with absolute paths or relative path traversal sequences such as ../. When an attacker can upload a model archive to a specific Amazon S3 prefix that is subsequently processed by the vulnerable SDK function, they can embed files within the tarball using maliciously constructed filenames. For instance, including entries like /etc/passwd or ../../../../critical_system_file allows the extraction process to bypass directory restrictions and overwrite sensitive system files or application configurations on the host machine where the SDK is running. This capability effectively grants the attacker write access to any file path that the user account executing the Python script has permissions to modify.
The operational impact of this vulnerability is severe, as it can lead to full remote code execution depending on the context in which the Cohere SDK operates. If the application processes untrusted model archives from external sources or compromised S3 buckets without strict validation, an attacker could replace critical binaries, inject malicious scripts into startup directories, or overwrite configuration files to alter application behavior. This aligns with ATT&CK technique T1059: Command and Scripting Interpreter if the overwritten files are executed, or T1222: File and Directory Permission Modifications if the goal is to escalate privileges by changing permissions on sensitive files. The risk is particularly high in environments where automated pipelines ingest model artifacts from less trusted sources, as the SDK assumes a level of trust in the integrity of the uploaded archives that may not be justified.
Mitigation strategies must focus on both immediate patching and architectural improvements. Users should immediately upgrade to a version of the Cohere Python SDK later than 7.2.0 where this vulnerability has been addressed by implementing proper path validation before extraction. In addition, developers integrating third-party model archives into their workflows should implement strict input sanitization at the application level. This includes validating that all archive member paths are contained within an expected base directory using canonical path resolution techniques such as os.path.realpath or pathlib.Path.resolve to detect and reject any traversal attempts. Furthermore, employing sandboxed execution environments for processing untrusted files can limit the blast radius of potential exploitation by restricting filesystem access rights regardless of SDK vulnerabilities.