Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49950— Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool

Quick assessment

Affected
xorbitsai xoscar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Xorbits Xoscar 0.11.2 及之前版本存在一个未授权的反序列化漏洞，攻击者可以通过在 actor-pool TCP 通道中发送精心构造的数据来执行任意代码。攻击者可以利用 函数，将未经验证的数据传递给 ，从而在消息类型验证之前触发 pickle 的 gadget 执行，最终实现在通常以 root 权限运行的 GPU 节点上作为服务器进程进行远程代码执行。

CVSS 9.8 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49950

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
Source: CVE Program / CVE List V5
Vulnerability Description
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
xorbitsai xoscar 0.1.0 ~ 0.11.2 -

II. Public POCs for CVE-2026-49950

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49950

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-49950 (1)

IV. Related Vulnerabilities

Same vendor: xorbitsai
Same weakness: CWE-502

V. Comments for CVE-2026-49950

No comments yet

Leave a comment