CVE-2026-108958

medium

Description

A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to deserialization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

References

https://vuldb.com/vuln/416777/cti

https://vuldb.com/vuln/416777

https://vuldb.com/submit/997885

https://vuldb.com/cve/CVE-2026-108958

https://github.com/tensorlayer/TensorLayer/issues/1169

https://github.com/tensorlayer/TensorLayer/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98267

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-14

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 6.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00259