Description

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-20T23:17:03.160Z",
  "pubdate": "2026-09-20T23:17:03.160Z",
  "executiveSummary": "A critical deserialization vulnerability exists in dmlc dgl versions up to 2.1.0.\nThe vulnerability resides within the load_info and _read_torch_data functions located in utils.py.\nBy manipulating the path argument, an attacker can trigger arbitrary code execution via unsafe deserialization of data.\nThis vulnerability is exploitable remotely, posing a significant risk to systems that process untrusted DGL data files.\nAs the exploit is public and the maintainers have not yet provided a patch, systems utilizing DGL are currently at high risk of compromise.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary commands with the privileges of the application process.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of data loading utilities within dmlc dgl, specifically the load_info and _read_torch_data functions in utils.py. The application leverages Python's pickle module or similar deserialization mechanisms to process input data files when loading internal state information.\nThe root cause is the failure to sanitize or validate the file path input provided to these functions, combined with the application's reliance on deserializing data structures from files retrieved via user-controlled paths. In the context of _read_torch_data, the function processes serialized PyTorch objects directly from the disk.\nThe attack flow begins when an attacker provides a maliciously crafted file to the application. Through the manipulation of the path argument, an attacker points the load_info routine to a payload file instead of a legitimate DGL data file. When the application attempts to read the content of the file using the affected functions, the underlying deserialization mechanism interprets the contents as executable code or serialized Python objects.\nBecause the function does not implement adequate access controls or file integrity verification, the process proceeds to instantiate the malicious objects embedded in the file. This leads to arbitrary code execution, as the deserialization process allows for the execution of arbitrary callables, a well-documented hazard associated with insecure pickle usage in Python.\nThe exploitation requirement is minimal, as the attack can be initiated remotely, provided the attacker can influence the path argument passed to the vulnerable utility. No authentication or elevated privileges are required if the target application exposes the functionality to the network. Post-exploitation, an attacker gains the ability to execute system commands, access sensitive environment variables, or exfiltrate data from the host machine, effectively bypassing standard application boundaries.\nAffected versions include all releases up to and including 2.1.0. Given that the exploit is public and the project has not responded to reported issues, the vulnerability remains unpatched in the current codebase."
}