xoscar vulnerabilities

1 known vulnerability in xoscar from Xorbitsai. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  xoscar: Deserialization of Untrusted Data

  CVE-2026-49950Oct 13, 2026Xorbitsai

  Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidat