High, CVSS 7.5PyPIAmendedPublished
amazon-braket-sdk vulnerable to Insecure Deserialization via pickle.loads()
CVE-2026-9291 · GHSA-g697-2xrc-gc46
- Affected
- PyPI amazon-braket-sdk >= 1.10.0, < 1.117.0
- Fixed in
- 1.117.0· Vendor fix available
- Issue
- Amazon Braket SDK is an open-source Python library for interacting with the Amazon Braket quantum computing service, including managing hybrid quantum jobs and retrieving job results. An issue exists where, under certain circumstances, a remote authenticated user with S3 write access to a Braket job output bucket can achieve arbitrary code execution by exploiting insecure deserialization in the job results processing component. Impact The SDK's deserializevalues() function reads the dataFormat field directly from the job results JSON file without validation. An actor with write access to the victim's S3 job output bucket can modify the dataFormat field in results.json from PLAINTEXT to pickledv4 and replace dataDictionary values with base64-encoded executable payloads. When the victim calls job.result(), loadjobresult(), or loadjobcheckpoint() as part of their normal Braket workflow, the SDK calls pickle.loads() on the actor-controlled data, executing arbitrary code with the…
Recommended action: Upgrade to 1.117.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.