CVE-2026-94092

Name of the Vulnerable Software and Affected Versions dmlc dgl versions prior to 2.1.0

Description A remote attack is possible through the manipulation of the path argument in the load info/ read torch data() function within the utils.py file, leading to deserialization. Deserialization occurs when data is converted from a format like a byte stream back into an object, which can be exploited to execute arbitrary code if the input is untrusted.

Recommendations As a temporary workaround, avoid using the path argument in the load info/ read torch data() function until a patch is available.