Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-94092: dmlc dgl up to 2.1.0 runs code from crafted path

CVE-2026-94092 · published 29 days ago

Summary

The dmlc DGL library (versions up to 2.1.0) contains a function that reads data from a file path without proper checks. An attacker who can control that path can cause the program to execute their own code, potentially from anywhere on the network. Upgrade to a newer version of DGL or apply the available patch, and avoid loading files from untrusted sources.

Original advisory text

dmlc dgl utils.py _read_torch_data deserialization

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-502Deserialization of Untrusted Data

Timeline

Published20 Sep 2026

Updated19 Oct 2026

First seen20 Sep 2026

Sources

CVE-2026-94092 · NVD

CVE-2026-94092 · OSV

Track software like this

Free during beta