CVE-2026-94092: dmlc dgl Deserialization RCE Vulnerability

CVE-2026-94092 Overview

CVE-2026-94092 is an insecure deserialization vulnerability affecting the Deep Graph Library (DGL) from dmlc through version 2.1.0. The flaw resides in the load_info and _read_torch_data functions within utils.py. An attacker who controls the path argument can trigger unsafe deserialization when the function processes attacker-supplied data. According to the advisory, the exploit is public and the project was informed through an issue report but has not yet responded. The weakness is classified under [CWE-20: Improper Input Validation].

Critical Impact

Exploitation can lead to arbitrary object deserialization during model or dataset loading, potentially compromising machine learning pipelines that ingest untrusted DGL data files.

Affected Products

• dmlc DGL (Deep Graph Library) versions up to and including 2.1.0
• Applications and ML pipelines that call load_info or _read_torch_data from utils.py
• Downstream projects bundling vulnerable DGL versions

Discovery Timeline

• 2026-09-20 - CVE-2026-94092 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94092

Vulnerability Analysis

The vulnerability exists in the load_info and _read_torch_data helpers in utils.py of the DGL project. These functions accept a file path argument and deserialize its contents, typically using PyTorch's torch.load, which internally relies on Python pickle. When the path points to attacker-controlled content, deserialization can instantiate arbitrary Python objects and invoke __reduce__ methods during unpickling. This behavior allows attacker-supplied gadget chains to run within the loading process. Because DGL is widely used in graph neural network research and production ML pipelines, unsafe loaders can be reached through dataset-sharing workflows, model checkpoints, and cached graph info files.

Root Cause

The root cause is missing validation of untrusted input passed into a deserialization routine. load_info and _read_torch_data treat the supplied path as trusted and hand off the file contents directly to a pickle-based loader with no signature verification, allow-list of classes, or safe-loader mode.

Attack Vector

An attacker crafts a malicious serialized file and induces a victim to load it through DGL, for example by publishing a poisoned dataset, checkpoint, or info.pkl artifact to a public model or data repository. When the victim application invokes load_info(path) or _read_torch_data(path) on that file, the malicious payload deserializes and executes as part of the loading process. User interaction is required to trigger the load. See the GitHub Issue #7932 and VulDB CVE-2026-94092 entry for additional technical detail.

No verified proof-of-concept code is included here. Refer to the linked references for public exploit information.

Detection Methods for CVE-2026-94092

Indicators of Compromise

• Unexpected child processes spawned by Python interpreters running DGL workloads, particularly shells or network utilities launched from data-loading code paths.
• Outbound network connections initiated during dataset or model loading operations that historically ran offline.
• DGL info.pkl, checkpoint, or graph data files sourced from untrusted repositories, mirrors, or user uploads.

Detection Strategies

• Instrument Python environments to log invocations of torch.load, pickle.load, and DGL load_info/_read_torch_data with the resolved file path and calling user.
• Perform static scanning of stored .pkl, .pt, and DGL artifact files for suspicious pickle opcodes such as GLOBAL, REDUCE, and imports of os, subprocess, or builtins.
• Compare hashes of loaded dataset files against a known-good manifest maintained for the ML pipeline.

Monitoring Recommendations

• Monitor host telemetry on ML training and inference nodes for anomalous process trees originating from Python workers.
• Track file writes to model, dataset, and cache directories from non-pipeline accounts.
• Alert on new or modified DGL artifacts appearing in shared storage without an associated build or training job.

How to Mitigate CVE-2026-94092

Immediate Actions Required

• Inventory all environments using dmlc DGL at version 2.1.0 or earlier and identify code paths that call load_info or _read_torch_data.
• Restrict these loaders to files produced by trusted internal pipelines only; block ingestion of DGL artifacts from external or user-supplied sources.
• Run DGL data-loading workloads under least-privilege service accounts with no outbound internet access where feasible.

Patch Information

At the time of publication, the DGL project had not responded to the reported issue and no fixed release is referenced in the advisory. Monitor the DGL GitHub repository and GitHub Issue #7932 for a maintainer response and patched release.

Workarounds

• Wrap calls to load_info and _read_torch_data with a path allow-list that only accepts files from vetted internal directories.
• Validate artifact integrity with cryptographic signatures or hash comparison before loading, and reject files that fail verification.
• Where possible, migrate to safer serialization formats such as JSON, Parquet, or safetensors for interchange with untrusted parties.
• Execute DGL data loading inside sandboxed containers with no network egress and read-only filesystem mounts outside working directories.

# Example: verify a DGL info file against a known-good SHA-256 before loading
EXPECTED="<known_good_sha256>"
ACTUAL=$(sha256sum ./data/info.pkl | awk '{print $1}')
if [ "$ACTUAL" != "$EXPECTED" ]; then
  echo "Integrity check failed; refusing to load" >&2
  exit 1
fi
python -c "from dgl.data.utils import load_info; load_info('./data/info.pkl')"