CVE-2024-34073

Affected versions of the sagemaker package are vulnerable to OS Command Injection due to improper handling of the `requirements_path` parameter. The `capture_dependencies` function in the `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module executes system commands based on user input without adequate validation or sanitization. An attacker can exploit this by supplying a malicious command as the "requirements_path" parameter, potentially leading to Remote Code Execution, Denial of Service, and compromising both confidentiality and integrity.