DLR-RM CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW DLR-RM CVE published 2026-09-20

CVE-2026-94093

A security vulnerability was detected in DLR-RM stable-baselines3 up to 2.9.0, affecting the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py, leading to deserialization. The exploit has been disclosed publicly and may be used. In v2.9.0, the PyTorch tensor load path was hardened (weights_only=True), but that hardening was later reverted. The core stable_baselines3 load APIs [truncated]