CVE-2026-95928

Name of the Vulnerable Software and Affected Versions recommenders-team recommenders versions prior to 1.2.2

Description A flaw in the Dict Loading component allows remote attackers to trigger deserialization. This occurs through the pickle.load() function within the recommenders/models/newsrec/io/mind iterator.py file. Deserialization is a process of converting a byte stream back into an object, which can lead to arbitrary code execution if the input is malicious.

Recommendations As a temporary workaround, restrict the use of the pickle.load() function in the recommenders/models/newsrec/io/mind iterator.py file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.