Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs

Fix availableCritical · CVSS 9.9EPSS 1.1%

Published Aug 10, 2026 · updated Nov 3, 2026

What to do

  1. Upgrade to a fixed version: feast 0.67.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIfeast66,168 downloads/week

Vulnerable versions
< 0.67.0
Fixed in
0.67.0

Check your project: pip show feast

Sources

CWE-502 Deserialization of Untrusted Data

← All critical vulnerabilities