CVE-2026-95897 Overview
CVE-2026-95897 is a deserialization vulnerability in the Dask parallel computing library affecting versions up to 2026.8.0. The flaw resides in the from_npy_stack function within dask/array/core.py, part of the Loader component. An attacker can supply crafted input that triggers unsafe deserialization during array loading. The issue has been categorized under [CWE-20] (Improper Input Validation) and can be triggered over a network with limited privileges and user interaction.
Critical Impact
Successful exploitation may lead to deserialization of attacker-controlled data with limited confidentiality, integrity, and availability impact. The exploit technique has been publicly disclosed.
Affected Products
- Dask versions up to and including 2026.8.0
- Component: Loader (dask/array/core.py)
- Function: from_npy_stack
Discovery Timeline
- 2026-09-23 - CVE CVE-2026-95897 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-95897
Vulnerability Analysis
Dask is a Python library for parallel and distributed computing that provides scalable analytics on arrays, dataframes, and task graphs. The from_npy_stack function loads a stack of NumPy .npy files from a directory into a Dask array. During this process, the loader deserializes metadata and array descriptors from the source location. When the input is attacker-controlled, the deserialization step processes untrusted data without sufficient validation.
The project maintainers were notified through a public issue report but had not responded at the time of disclosure. This means downstream consumers must apply compensating controls until an upstream fix is available.
Root Cause
The root cause is improper input validation [CWE-20] in the from_npy_stack loader path. The function trusts metadata contained within the loaded stack and passes it through Python deserialization primitives. No integrity check or schema validation is enforced before objects are reconstructed in memory.
Attack Vector
An attacker delivers a malicious .npy stack directory to a target system running Dask. When a user or automated pipeline calls from_npy_stack against that path, the crafted payload is deserialized. The attack requires user interaction, such as invoking the loader against attacker-supplied storage, and low privileges on the target. Because Dask is commonly used in shared data science environments and pipelines that ingest external datasets, path exposure is a realistic delivery vector.
// No verified proof-of-concept code is published.
// See the GitHub issue for technical discussion:
// https://github.com/dask/dask/issues/12578
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-95897
Indicators of Compromise
- Unexpected .npy or metadata files appearing in directories consumed by Dask pipelines
- Python processes spawning child processes or making outbound network connections shortly after calls to from_npy_stack
- Unusual file reads under directories referenced by Dask loader jobs originating from untrusted sources
Detection Strategies
- Inventory Python environments for installed Dask versions and flag any version at or below 2026.8.0
- Instrument data ingestion code paths that call from_npy_stack and log the source paths being loaded
- Alert on Dask worker processes performing operations outside expected compute behavior, such as shell invocations or credential file access
Monitoring Recommendations
- Monitor package inventories in data science and ML workloads for vulnerable Dask releases
- Track filesystem access patterns of Dask worker processes for reads from untrusted or user-writable locations
- Correlate loader invocations with subsequent process, network, or file activity to identify post-deserialization behavior
How to Mitigate CVE-2026-95897
Immediate Actions Required
- Restrict from_npy_stack usage to directories controlled by trusted producers only
- Validate and sandbox any Dask pipelines that ingest datasets from external or multi-tenant sources
- Review data science workflows for exposure of the loader function to untrusted input paths
Patch Information
At the time of publication, no upstream patch has been released. The maintainers were informed through a public issue report but had not responded. Track the GitHub Issue #12578 and the Dask repository for fix availability. Reference details are also tracked in VulDB CVE-2026-95897.
Workarounds
- Avoid calling from_npy_stack on paths sourced from untrusted users or external systems
- Run Dask workers under least-privilege service accounts with restricted filesystem and network egress
- Execute Dask jobs that must ingest external data in isolated containers or ephemeral sandboxes
- Apply integrity checks such as cryptographic hashes to .npy stacks before loading
# Identify installed Dask version across Python environments
python -c "import dask; print(dask.__version__)"
# Example: restrict loader to a known-trusted directory
export DASK_TRUSTED_INPUT_DIR=/opt/data/trusted
find "$DASK_TRUSTED_INPUT_DIR" -type d -perm -o+w -print
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
