Summary
This advisory addresses the use of the search_hub() function within the SageMaker Python SDK's JumpStart search functionality. An actor with the ability to control query parameters passed to the search_hub() function could potentially provide malformed input that causes the eval() function to execute arbitrary commands, access sensitive data, or compromise the execution environment.
A defense-in-depth enhancement has been implemented to replace code evaluation with safe string operations when processing search query parameters. This enhancement removes the use of eval() from the execution path, replacing it with a safe recursive descent parser. The change was released in SageMaker Python SDK version 3.4.0 on January 23, 2026. This advisory is informational to help customers understand their responsibilities regarding input validation and configuration security under the AWS Shared Responsibility Model.
Workarounds
No workarounds are needed, but as always you should ensure that your application is following security best practices:
- Sanitize and validate input to SDK methods to ensure only expected formats are processed
- Update to the latest SageMaker Python SDK release on a regular basis
- Follow AWS security best practices for SDK configuration and usage
- Ensure proper access controls are in place for environments where the SDK is deployed
References
- Fixed in PR: https://github.com/aws/sagemaker-python-sdk/pull/5497
- Release: https://pypi.org/project/sagemaker/3.4.0/
- AWS Shared Responsibility Model: https://aws.amazon.com/compliance/shared-responsibility-model/
If you have any questions or comments about this advisory, contact AWS Security via our vulnerability reporting page or email [email protected]. Please do not create a public GitHub issue.
Acknowledgement
We thank Dan Aridor (@daridor9) and the security research community for bringing these customer security considerations to our attention through the coordinated disclosure process and for collaborating on this issue through responsible disclosure practices.
Impact
Customer applications that pass unsanitized or untrusted input directly to the search_hub() function's query parameter could be prone to Remote Code Execution (RCE), potentially allowing attackers to execute arbitrary commands, access sensitive data, or compromise the execution environment. While the SDK was functioning within the requirements of the shared responsibility model, where input sanitization falls on the customer side, additional safeguards have been added to support secure customer implementations and provide defense-in-depth protection.
Impacted versions: All versions of SageMaker Python SDK prior to 3.4.0
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Remediation advice
On January 23, 2026, an enhancement was made to SageMaker Python SDK version 3.4.0, which replaces eval() with a safe recursive descent parser that uses string operations for pattern matching with proper operator precedence and exception handling. We recommend upgrading to version 3.4.0 or later, using the following command:
pip install --upgrade sagemaker>=3.4.0
Customers using forked or derivative code should incorporate the fixes from the referenced pull request.
Frequently Asked Questions
- What is GHSA-5R2P-PJR8-7FH7? GHSA-5R2P-PJR8-7FH7 is a high-severity security vulnerability in sagemaker (pip), affecting versions < 3.4.0. It is fixed in 3.4.0.
- Which versions of sagemaker are affected by GHSA-5R2P-PJR8-7FH7? sagemaker (pip) versions < 3.4.0 is affected.
- Is there a fix for GHSA-5R2P-PJR8-7FH7? Yes. GHSA-5R2P-PJR8-7FH7 is fixed in 3.4.0. Upgrade to this version or later.
- Is GHSA-5R2P-PJR8-7FH7 exploitable, and should I be worried? Whether GHSA-5R2P-PJR8-7FH7 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-5R2P-PJR8-7FH7 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-5R2P-PJR8-7FH7? Upgrade
sagemakerto 3.4.0 or later.