CVE-2026-122188

A checkpoint can redirect graph evaluation to unintended local data

DeepGraphLearning · KnowledgeGraphEmbedding checkpoint configuration

First documented disclosure · Review checkpoint

Summary

A third-party checkpoint can select the dataset directory used by the evaluator and expose part of a local file in an error message.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher reproduced the local marker disclosure and an in-package control case. No unauthorized access to a production environment was reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

When no explicit data path is supplied, the loader adopts the checkpoint’s data_path and reads fixed dataset filenames beneath it without enforcing a package boundary.

Conditions required

A user runs evaluation or training with an attacker-supplied checkpoint, omits the data-path override and has permission to read the selected files. The demonstrated error requires a nonnumeric first field.

Potential impact

The researcher showed a marker from the first field of entities.dict appearing in the terminal and test log. Evaluation can also consume an unintended dataset. Exposure beyond local output requires another route to that output.

Affected versions and configurations

The researcher reproduced the issue at 2e440e0f9c687314d5ff67ead68ce985dc446e3a, the revision identified by VulDB. An earlier affected range was not established.

Fix and mitigation status

No issue-specific fixed revision was verified. The project uses rolling source revisions.

Practical next steps

Select a trusted dataset explicitly with the data-path override and isolate checkpoint processing from sensitive files. Review diagnostic output before sharing it.

Operating lesson

Treat a model-supplied dataset path as untrusted input before resolving it against the host filesystem.

Evidence and limits

The October 13 public report predates the November 4 VulDB disclosure and November 5 CVE. The demonstrated path requires a named dataset file, not an arbitrary file name. It reaches the error before the separate pickle-loading step.

Sources