TI-2026-53679 CVE-2026-76843 · GHSA-58g9-h5rx-pf95
Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load
Priority LOW 39
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while…