Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-95928

recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization

CVSS 4.0 5.1 MEDIUMCVSS 3.1 5.5 MEDIUMCVSS 3.0 5.5 MEDIUMCVSS 2.0 6.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-95928

Published

A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-95928

Published

recommenders

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "recommenders-team",
                    "product": "recommenders",
                    "versions": [
                        {
                            "version": "1.2.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.2.1",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:recommenders-team:recommenders:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Dict Loading"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON