CVE-2026-108958

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108958
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108958.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108958
Published
2026-10-13T02:30:16Z
Modified
2026-10-16T02:30:26Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
Details

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-20",
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108958.json"
}
References

Affected packages

Git / github.com/tensorlayer/tensorlayer

Affected ranges

Type
GIT
Repo
https://github.com/tensorlayer/tensorlayer
Events
Introduced
ca882d63920426c1f5480247a1c134035159664d
Last Affected
93905f057e74d87be7c7d29de40ef917b758db8e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.2.0"
        },
        {
            "last_affected":  "2.2.0"
        },
        {
            "introduced":  "2.2.1"
        },
        {
            "last_affected":  "2.2.1"
        },
        {
            "introduced":  "2.2.2"
        },
        {
            "last_affected":  "2.2.2"
        },
        {
            "introduced":  "2.2.3"
        },
        {
            "last_affected":  "2.2.3"
        },
        {
            "introduced":  "2.2.4"
        },
        {
            "last_affected":  "2.2.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
v2.*
v2.2.0
v2.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108958.json"