CVE-2026-94092: dmlc dgl utils.py _read_torch_data deserialization
A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function loadinfo/readtorchdata of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects dmlc dgl versions up to 2.1.0, specifically code paths that invoke load_info or _read_torch_data in utils.py with a manipulable path argument.
What access does an attacker need?
The supplied severity vector indicates network reachability, low attack complexity, low privileges, and required user interaction. Exploitation requires manipulating the path argument to trigger deserialization.
Is public exploit code available?
Yes. The vulnerability information states that an exploit is public and may be used.
What should teams do if they cannot patch immediately?
Avoid allowing untrusted parties to control path values passed to load_info or _read_torch_data. Restrict network exposure and limit access to interfaces that can reach these functions.