Dgl
Monthly
Unsafe deserialization in dmlc DGL (Deep Graph Library) up to and including 2.1.0 allows arbitrary code execution when a victim loads a crafted DGL graph info artifact through the load_info / _read_torch_data path in utils.py, which hands an attacker-influenced 'path' to torch.load and therefore to Python's pickle machinery. Per the authoritative assessment this is an untrusted-input/supply-chain scenario rather than a network-service exploit: no memory-safety trigger exists and DGL exposes no network-facing listener by default, so the attacker must deliver a malicious serialized file (shared dataset, model artifact, or downloaded graph) and induce the user to open it, which is why the assessed vector requires user interaction. A publicly available exploit code exists (linked to GitHub issue dmlc/dgl#7932) and the maintainers were notified via issue report but had not responded at the time of analysis; note that CVE-2026-94092 is not listed in CISA KEV, so there is no confirmation of active exploitation. Vendor data records a CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/E:P), while our independent assessment rates the practical impact higher (CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful unpickling yields full code execution in the victim's context.
Unsafe deserialization in dmlc DGL (Deep Graph Library) up to and including 2.1.0 allows arbitrary code execution when a victim loads a crafted DGL graph info artifact through the load_info / _read_torch_data path in utils.py, which hands an attacker-influenced 'path' to torch.load and therefore to Python's pickle machinery. Per the authoritative assessment this is an untrusted-input/supply-chain scenario rather than a network-service exploit: no memory-safety trigger exists and DGL exposes no network-facing listener by default, so the attacker must deliver a malicious serialized file (shared dataset, model artifact, or downloaded graph) and induce the user to open it, which is why the assessed vector requires user interaction. A publicly available exploit code exists (linked to GitHub issue dmlc/dgl#7932) and the maintainers were notified via issue report but had not responded at the time of analysis; note that CVE-2026-94092 is not listed in CISA KEV, so there is no confirmation of active exploitation. Vendor data records a CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/E:P), while our independent assessment rates the practical impact higher (CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful unpickling yields full code execution in the victim's context.