A security vulnerability has been detected in Dask up to 2026.8.0. (CVE-2026-95897)

CVE-2026-95897 is a security vulnerability in the Dask library affecting the from_npy_stack function within the dask/array/core.py file, specifically in the Loader component. The flaw allows an attacker to manipulate deserialization remotely, potentially impacting confidentiality, integrity, and availability. The vulnerability affects multiple specific versions of Dask, including various Ubuntu package versions. The vulnerability has a CVSS v3.1 base score of 5.5, indicating medium severity. The project was informed early but has not yet issued a fix or response. Public disclosure of the exploit exists, but no active exploitation has been confirmed.

The vulnerability allows remote attackers to manipulate deserialization in Dask, which can lead to partial loss of confidentiality, integrity, and availability. The CVSS score of 5.5 reflects a medium impact level. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded yet and no official fix is available, users should monitor official Dask channels for updates. Until a fix is released, avoid processing untrusted input with the affected from_npy_stack function or apply additional input validation controls where possible.