CVE-2026-108597

Published 10 October 2026 · tracked since 11 October 2026

Description

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-62050 CRITICAL 9.8
• CVE-2026-62051 CRITICAL 9.8
• CVE-2026-62052 CRITICAL 9.8
• CVE-2026-62053 CRITICAL 9.8
• CVE-2026-62035 MEDIUM 6.3
• CVE-2026-62021 HIGH 8.8
• CVE-2026-42719 CRITICAL 9.8
• CVE-2026-42723 CRITICAL 9.8
• CVE-2026-42716 CRITICAL 9.8
• CVE-2026-42718 CRITICAL 9.8

→ Open the live CVE board · all tools