CVE-2026-95897
Received Received - Intake

Deserialization Flaw in Dask up to 2026.8.0

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95897
EUVD
EUVD-2026-84993

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Dask up to version 2026.8.0, specifically in the from_npy_stack function of dask/array/core.py. It allows deserialization of untrusted data through an unprotected pickle.load operation when loading metadata from an info file. Attackers can exploit this to execute arbitrary code remotely if they can modify or supply the stack directory.

Detection Guidance

To detect this vulnerability, inspect Dask installations for versions up to 2026.8.0. Check for suspicious .npy stack files with modified info files. Monitor for unexpected code execution during file loading. No specific commands are provided in the context.

Impact Analysis

If you use affected Dask versions, an attacker could execute malicious code on your system by providing a specially crafted stack directory. This could lead to unauthorized access, data theft, or system compromise. The vulnerability is particularly risky because the stack format is designed to be shareable, making it easy to distribute malicious payloads.

Mitigation Strategies

Immediately upgrade Dask to a version beyond 2026.8.0 if available. Avoid loading untrusted .npy stack files. Restrict access to directories containing these files. Disable deserialization of info files if possible. Monitor for exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart