CVE-2026-94092

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94092

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94092.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94092

Published

2026-09-20T22:30:17Z

Modified

2026-09-25T03:30:29Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

dmlc dgl utils.py _read_torch_data deserialization

Details

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-20",
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94092.json"
}

References

Affected packages

Git / github.com/dmlc/dgl

Affected ranges

Type

GIT

Repo

https://github.com/dmlc/dgl

Events

Introduced

92c8f08de46fa568e42ab65387e840772c4622e6

Last Affected

1547bd931d17cd1da144a6d38bb687c0f2c3b364

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.0"
        },
        {
            "last_affected":  "2.0"
        },
        {
            "introduced":  "2.1.0"
        },
        {
            "last_affected":  "2.1.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

2.*

2.0

2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94092.json"