---
id: "CVE-2026-18948"
kind: "vulnerability"
aliases: ["CVE-2026-18948", "GHSA-gg2p-37pv-v7fq"]
title: "Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs"
severity: "critical"
cvss: 9.9
epss: 0.01079
exploited: false
status: "open"
category: "package"
products: [{"name": "feast", "fixed": ["0.67.0"], "affected": "< 0.67.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-502", "feast", "feature-store", "package", "python", "self-hosted"]
not_affected_if: ["fixed-version-0.67.0"]
published_at: "2026-08-10T21:17:21+00:00"
first_seen_at: "2026-11-03T16:25:28+00:00"
updated_at: "2026-11-03T16:51:48+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gg2p-37pv-v7fq", "first_seen_at": "2026-11-03T16:25:28+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18948", "first_seen_at": "2026-11-03T16:51:48+00:00"}]
---

# Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs

Feast, a Python feature store, deserializes user-defined functions stored in its registry using the dill library without safe checks. A remote attacker can store a malicious UDF and get arbitrary code execution on the feature server, and an authenticated user can do the same on the registry server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:feast affected < 0.67.0 fixed 0.67.0

## How to check

- Check the installed Feast version with `pip show feast` and compare it with the affected range below.
- Look for a feature server or registry server running a Feast version below `0.67.0`.
- Confirm whether the registry accepts UDFs from untrusted users, since the sources say exposure is default-config.

## Fix

- Upgrade feast to `0.67.0` or later.

## Timeline

- 2026-11-03T16:25:28+00:00 ghsa https://github.com/advisories/GHSA-gg2p-37pv-v7fq
- 2026-11-03T16:51:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18948

## Documents

- [fix] Patch: github.com https://github.com/feast-dev/feast/pull/6861
- [fix] Patch: github.com https://github.com/feast-dev/feast/commit/e0ef16ea1ed149ecd5dc9d4d0aa0fdbfa547f861
- [fix] Release: github.com https://github.com/feast-dev/feast/releases/tag/v0.67.0

## From the sources

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_