Medium severity · published Sep 23, 2026
CVE-2026-95897
Dask Loader core.py from_npy_stack deserialization
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Dask · Dask
2026.0; 2026.1; 2026.2; 2026.3; 2026.4; 2026.5; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95897
github.com
https://github.com/dask/dask/
github.com
https://github.com/dask/dask/issues/12578
vuldb.com
https://vuldb.com/cve/CVE-2026-95897
vuldb.com
https://vuldb.com/submit/953281
vuldb.com
https://vuldb.com/vuln/408543
vuldb.com
https://vuldb.com/vuln/408543/cti
More from Dask
3.1
CVE-2026-10705
dask HLL hyperloglog.py nunique_approx resource consumption