Executive brief
Recommenders is a library providing recommendation system models. An unsafe deserialization vulnerability in the MIND news recommendation iterator allows remote attackers to execute arbitrary code by providing malicious pickle dictionary files during model training initialization. The vulnerability requires the attacker to control the dictionary files passed to the iterator, enabling full system compromise.
Technical details
The vulnerability exists in the MINDIterator constructor which calls pickle.load() on four dictionary files without validation. An attacker can craft a malicious pickle file containing executable Python code that is deserialized and executed when the iterator is initialized. This is a classic unsafe deserialization flaw where the pickle format itself can carry arbitrary payloads indistinguishable from benign data at the byte level.
Affected products
- recommenders-team recommenders up to 1.2.1
Timeline
- 2026-08-30: disclosed: Issue reported to maintainers
- 2026-09-23: advisory: CVE-2026-95928 published