Cohere Python SDK CVE-2026-108597

Exploitation requires three concrete conditions: (1) the victim uses the Cohere Python SDK cohere_aws SageMaker flow that calls _s3_models_dir_to_tarfile and extracts model archives via tarfile.extractall; (2) the attacker can write model archives (tar files) into the victim's S3 prefix/bucket that the SDK reads from - a trusted-write position, not open network access; and (3) the victim host must trigger the extraction (passive user interaction, UI:P). Limiting factors: this is NOT remote unauthenticated exploitation against a default configuration - it depends on using the specific SageMaker model-archive feature, on the attacker holding write access to the model S3 location, and on running an affected SDK version (5.11.0 through 7.2.0). The crafted-archive-plus-write-access requirement (reflected as AT:P/PR:L) substantially narrows realistic exploitation.

This is a medium-severity, precondition-heavy integrity flaw rather than a broad remote threat. The authoritative CVSS 4.0 vector (base 5.9) reports AV:N but pairs it with AT:P (a specific attack requirement), PR:L (attacker needs some privilege), and UI:P (passive victim interaction), with impact limited to VI:H and VC:N/VA:N - i.e., arbitrary file write/overwrite, no direct confidentiality or availability loss. The gating precondition is decisive: the attacker must already be able to write model archives into the victim's S3 prefix, which is a trust-boundary/supply-chain position, not open internet access, so the AV:N 'network' label overstates reachability for most deployments. No EPSS score was provided, there is no CISA KEV listing, and no turnkey exploit code is indicated in the input (a technical writeup exists on hackmd, but that is analysis, not confirmed POC code). Taken together the signals point to a targeted, conditional issue affecting a specific Cohere AWS SageMaker code path - a genuine priority only for organizations that use that SageMaker model-archive flow and load archives from an S3 location an attacker could influence; for everyone else it is a lower real-world priority than the 5.9 might suggest.

An attacker who can write objects to the S3 prefix the victim loads Cohere SageMaker model archives from uploads a crafted tar containing members with '../' sequences or absolute paths. When the Cohere Python SDK host later calls tarfile.extractall in _s3_models_dir_to_tarfile, those members are written outside the intended directory, overwriting arbitrary files on the host and potentially leading to code execution. A technical writeup describing the tar-slip technique is publicly available, but no confirmed weaponized exploit is indicated in the input.