| शीर्षक | dask ≤2026.8.0 rce |
|---|
| विवरण | to_npy_stack/from_npy_stack is the documented on-disk array stack format: a directory of 0.npy, 1.npy, ... chunks plus a single info metadata file. The loader deserializes that metadata file with a bare pickle.load. The stack directory is an explicitly shareable dataset format (copy/ship the directory), and mmap_mode only selects memory mapping. No parameter of the call, no dask config key, and no environment variable can block the deserialization — anyone who can supply or tamper a stack directory executes arbitrary code on every worker that reads it. Raw pickle.load is unaffected by TORCH_FORCE_WEIGHTS_ONLY_LOAD. |
|---|
| स्रोत | ⚠️ https://github.com/dask/dask/issues/12578 |
|---|
| उपयोगकर्ता | __lbz__ (UID 100868) |
|---|
| सबमिशन | 30/08/2026 07:20 AM (26 दिन पहले) |
|---|
| संयम | 22/09/2026 07:07 PM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408543 [Dask तक 2026.8.0 Loader dask/array/core.py from_npy_stack अधिकार वृद्धि] |
|---|
| अंक | 19 |
|---|