Description
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-23
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Remote code execution via deserialization
Action: Patch
AI Analysis

Impact

This vulnerability allows attackers to deserialize data from arbitrary sources via the from_npy_stack function in the Loader module of Dask. The resulting deserialization could enable execution of arbitrary code on the host if untrusted input is processed.

Affected Systems

All releases of the Dask library up to and including version 2026.8.0 contain the flaw. The affected component is the Loader implementation within dask/array/core.py. The issue is purely software‑level and can appear in any environment that deploys the impacted Dask code.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, and a publicly disclosed exploit exists, which increases the likelihood compared to an unknown theoretical flaw. The lack of a vendor patch at the time of report means the risk remains until a fix or mitigative measure is applied.

Generated by OpenCVE AI on September 23, 2026 at 02:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update to a patched version of Dask that addresses the deserialization issue or apply any upstream patch if available.
  • If upgrading is not immediately possible, restrict the use of from_npy_stack to signed or internally trusted data only, or remove the call from production workloads.
  • Set up notifications on the Dask GitHub repository or security advisories to receive timely information about the release of a fix.

Generated by OpenCVE AI on September 23, 2026 at 02:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title Dask Loader core.py from_npy_stack deserialization
First Time appeared Dask
Dask dask
Weaknesses CWE-20
CWE-502
CPEs cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*
Vendors & Products Dask
Dask dask
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dask Dask
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-23T00:30:14.623Z

Reserved: 2026-09-22T17:07:14.182Z

Link: CVE-2026-95897

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T01:16:31.920

Modified: 2026-09-23T01:16:31.920

Link: CVE-2026-95897

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T02:30:17Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-502

    Deserialization of Untrusted Data