This vulnerability affects dmlc dgl up to version 2.1.0, specifically the load_info/_read_torch_data function in utils.py. An attacker can remotely manipulate the path argument to trigger unsafe deserialization, potentially leading to arbitrary code execution or other impacts associated with deserialization flaws. The issue was reported early to the project but remains unpatched. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation can allow an attacker to perform unauthorized deserialization remotely, which may lead to arbitrary code execution or compromise of the affected system. The CVSS 4.0 score of 5.1 indicates a medium impact with network attack vector, low complexity, and limited privileges required. The vulnerability affects confidentiality, integrity, and availability to a limited extent.

No official patch or fix has been released by the vendor yet. Users should monitor the vendor's communications for updates. Until a fix is available, avoid processing untrusted input through the vulnerable functions or restrict access to the affected functionality to trusted users only.