DLR-RM stable-baselines3 up to 2.9.0 save_util.py PPO.load/load_replay_buffer/VecNormalize.load deserialization

Summaryinfo

A vulnerability was found in DLR-RM stable-baselines3 up to 2.9.0. It has been classified as critical. This impacts the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Performing a manipulation results in deserialization. This vulnerability is identified as CVE-2026-94093. The attack can be initiated remotely. Additionally, an exploit exists. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

Detailsinfo

A vulnerability was found in DLR-RM stable-baselines3 up to 2.9.0. It has been classified as critical. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-94093. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known.

It is declared as proof-of-concept. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-83800). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• DLR-RM

Name

• stable-baselines3

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9.0

Website

• Product: https://github.com/DLR-RM/stable-baselines3/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #952734: DLR-RM stable-baselines3 v2.9.0 rce (by __lbz__)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion