A flaw in the Amazon SageMaker Python SDK allows a remote authenticated actor with S3 write access to replace model artifacts with a specially crafted pickle file. The SDK loads the artifact without integrity verification, enabling the attacker to execute arbitrary code inside the inference container during Triton model initialization. The weakness is a lack of model integrity check (CWE‑354).

The issue affects Amazon SageMaker Python SDK version 2 prior to 2.257.2 and version 3 prior to 3.8.0 when building Triton inference models with ModelBuilder. Any deployment that loads model artifacts from S3 using these SDK versions is vulnerable.

The CVSS base score of 6.4 indicates moderate severity. Exploitation requires only remote authentication and S3 write permission to the designated model artifact path; no local privileges or special network access are needed. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread attacks is uncertain, but the potential impact warrants immediate attention.