Insecure deserialization in the job results processing component in Amazon Braket SDK before 1.117.0 might allow a remote authenticated user with S3 write access to the job output bucket to achieve arbitrary code execution on any machine that processes job results.
We recommend you upgrade to amazon-braket-sdk version 1.117.0 or later.
Exploitability
AV:NAC:HAT:PPR:LUI:PVulnerable System
VC:HVI:HVA:HSubsequent System
SC:NSI:NSA:N7.5/CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSerialization