Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

stable-baselines3 model loading can execute remote code

CVE-2026-94093 · published 29 days ago
Summary

The stable-baselines3 library (up to version 2.9.0) lets an attacker craft a specially designed file that, when loaded with functions like PPO.load or VecNormalize.load, runs arbitrary code on the server. This means a malicious user could take control of a system that automatically loads such files. Update to a version where the loading process is hardened or avoid loading untrusted files altogether.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dlr-rm stable-baselines3 2.0
Original advisory text
DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization
A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-502Deserialization of Untrusted Data
Timeline
Published20 Sep 2026
Updated19 Oct 2026
First seen20 Sep 2026
Sources
CVE-2026-94093 · NVD
CVE-2026-94093 · MITRE
CVE-2026-94093 · OSV
Track software like this
Free during beta