🛡️ GHSA-3x5x-fw77-g54c — dgl
Description
dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()
Impact
Dgl implements rpc server (start_server() in rpc_server.py) for supporting the RPC communications among different remote users over networks. It relies on pickle serialize and deserialize to pack and unpack network messages. The is a known risk in pickle deserialization functionality that can be used for remote code execution.
Patches
TBD.
Workarounds
When running DGL distributed training and inference (DistDGL) make sure you do not assign public IPs to any instance in the cluster.
References
Issue #7874
Reported by
Pinji Chen ([[email protected]](mailto:[email protected])) from NISL lab (https://netsec.ccert.edu.cn/about) at Tsinghua University
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality high, integrity high, availability high.
Weakness class
GHSA-3x5x-fw77-g54c is classified as CWE-502: Deserialization of Untrusted Data. Serialised data from an untrusted source is reconstructed into objects, which can trigger code during the process.
Affected software
GHSA-3x5x-fw77-g54c is recorded against 1 package.
- dgl
Timeline and source
Published on 5 March 2025. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
Details
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| dgl | — | — |
References
Similar Threats
- Unknown MAL-2026-1432
Site Security Check
Is dgl part of your stack?
GHSA-3x5x-fw77-g54c is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.