Answer in brief
CVE-2026-49950 records a Critical severity (CVSS 9.3) vulnerability in Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool. The current sources do not mark it as known exploited. The current feed maps xorbitsai/xoscar (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps xorbitsai/xoscar (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| xorbitsai/xoscargeneric | >=0.1.0 <=0.11.2 | Not reported |
Published upstream
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 13, 2026
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which triggers pickle __reduce__ gadget execution before message type validation, achieving remote code execution as the server process which commonly runs as root on GPU nodes.
Quoted source text, attributed separately from HOL analysis.