Approved changes feed: RSS · Atom
cpe:2.3:a:xorbitsai:xoscar:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Xorbitsai (dc99c771-ac5e-587f-b6eb-eafcf9bbe133) |
|---|---|
| Product | Xoscar (36d8f54a-33f2-5378-9c14-b347cc4ac2c5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49950 |
vulnerable | 2026-11-03 10:15:58.096365 |
Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
CRITICAL (9.8)
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
Published: 2026-10-13T20:20:36.251Z
Updated: 2026-10-16T14:30:16.304Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.