Executive brief
Dask is a parallel computing library that processes distributed arrays using task scheduling. The from_npy_stack function, used to load array data from disk, deserializes metadata without validation, allowing an attacker who controls a dataset directory to execute arbitrary code on any system loading it. This poses a critical risk when sharing or receiving numpy stack datasets from untrusted sources.
Technical details
The vulnerability is an unsafe deserialization issue in dask/array/core.py where from_npy_stack uses pickle.load() without validation on the info metadata file. An attacker can craft a malicious info file that executes arbitrary code during unpickling, with no config option or parameter to disable this behavior. The attack requires network or local access to supply or modify the stack directory before it is loaded.
Affected products
- Dask Dask up to 2026.8.0
Timeline
- 2026-08-30: disclosed: Issue reported publicly on GitHub
- 2026-09-23: advisory: CVE-2026-95897 published