Description
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-23
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via deserialization
Action: Patch
AI Analysis

Impact

This vulnerability allows attackers to deserialize data from arbitrary sources via the from_npy_stack function in the Loader module of Dask. The resulting deserialization could enable execution of arbitrary code on the host if untrusted input is processed.

Affected Systems

All releases of the Dask library up to and including version 2026.8.0 contain the flaw. The affected component is the Loader implementation within dask/array/core.py. The issue is purely software‑level and can appear in any environment that deploys the impacted Dask code.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and a publicly disclosed exploit exists, which increases the likelihood compared to an unknown theoretical flaw. The lack of a vendor patch at the time of report means the risk remains until a fix or mitigative measure is applied.

Generated by OpenCVE AI on September 23, 2026 at 02:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a patched version of Dask that addresses the deserialization issue or apply any upstream patch if available.
  • If upgrading is not immediately possible, restrict the use of from_npy_stack to signed or internally trusted data only, or remove the call from production workloads.
  • Set up notifications on the Dask GitHub repository or security advisories to receive timely information about the release of a fix.

Generated by OpenCVE AI on September 23, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 23 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title Dask Loader core.py from_npy_stack deserialization
First Time appeared Dask
Dask dask
Weaknesses CWE-20
CWE-502
CPEs cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*
Vendors & Products Dask
Dask dask
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dask Dask
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-23T15:01:52.551Z

Reserved: 2026-09-22T17:07:14.182Z

Link: CVE-2026-95897

cve-icon Vulnrichment

Updated: 2026-09-23T15:01:24.738Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T01:16:31.920

Modified: 2026-09-23T15:17:31.147

Link: CVE-2026-95897

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T00:30:14Z

Links: CVE-2026-95897 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T02:30:17Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-502

    Deserialization of Untrusted Data