MediumVulnerability
CVE-2026-94093: DLR-RM stable-baselines3 unsafe deserialization in PPO.load
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-94093
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
CVE-2026-94093 affects DLR-RM stable-baselines3 up to 2.9.0, specifically the PPO.load, load_replay_buffer and VecNormalize.load functions in save_util.py. Crafted input leads to unsafe deserialization that can be triggered remotely, and a public exploit exists. Version 2.9.0 added weights_only=True hardening to the PyTorch tensor load path, but PR #1913 reverted it on master to fix PyTorch 1.13 compatibility, and these core load APIs have no safe mode or gate.
Mitigation
The source states that the outstanding hardening in PR #2264 is pending and has not yet shipped. No fixed version is given.
Related items
- MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
- MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
- HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database