CVE-2026-94093

Received Received - Intake

Insecure Deserialization in Stable-Baselines3

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-20

Last Modified

2026-09-20

Generated

2026-09-21

AI Q&A

2026-09-21

EPSS Evaluated

N/A

NVD

CVE-2026-94093

EUVD

EUVD-2026-83800

Affected Vendors & Products

Vendor	Product	Version / Range
dlr	stable_baselines3	to 2.9.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is a deserialization flaw in DLR-RM stable-baselines3 up to version 2.9.0. It affects functions like PPO.load, load_replay_buffer, and VecNormalize.load in the save_util.py file. Attackers can remotely exploit this by manipulating deserialization processes, potentially executing arbitrary code.

Detection Guidance

This vulnerability involves unsafe deserialization in stable-baselines3's PPO.load, load_replay_buffer, and VecNormalize.load functions. Detection requires checking for vulnerable versions (up to 2.9.0) and inspecting code using these functions for pickle deserialization without weights_only=True. No specific commands are provided in the context.

Impact Analysis

If you use affected versions of stable-baselines3, an attacker could remotely execute malicious code on your system. This could lead to data breaches, system compromise, or unauthorized access. The exploit is publicly known and may already be used in attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected software may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade to a patched version once available (PR #2264 hardening). Avoid loading untrusted files with PPO.load, load_replay_buffer, or VecNormalize.load. Use weights_only=True if possible. Monitor for suspicious activity related to deserialization.

Hi! I’m here to help you understand CVE-2026-94093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70