Description

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that attacker's code with the privileges of the loading process. This is the same sink and the same file as CVE-2024-10073, which records 0.15.0 as the fixed version on the basis that clustering support was dropped in that release; the module was removed from the documented API but remains present in the distributed artifact and reachable by importing flair.models.clustering directly, so the earlier record's fixed version does not hold for the shipped package.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-24T14:17:02.087Z",
  "pubdate": "2026-08-24T14:17:02.087Z",
  "executiveSummary": "An insecure deserialization vulnerability exists in the Flair natural language processing framework, specifically within the ClusteringModel class in flair/models/clustering.py. The vulnerability allows the execution of arbitrary Python code when an unsuspecting user loads a maliciously crafted model file. This issue represents an incomplete fix or bypass of CVE-2024-10073, where the vulnerable module was supposedly removed from the documented API in version 0.15.0 but remained present in the distributed wheel artifacts for versions 0.15.0 and 0.15.1.\nThe impact of this vulnerability is severe, leading to arbitrary remote code execution (RCE) within the context of the user or process loading the malicious model. An attacker possessing the capability to supply or replace a model file can compromise the host environment, potentially leading to full system compromise, data exfiltration, or lateral movement depending on the privileges of the loading process. Exploitation requires the target application to explicitly or implicitly import the vulnerable clustering module and deserialize an untrusted model file utilizing the insecure load method.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure usage of Python's pickle module combined with joblib loading mechanisms. Specifically, the ClusteringModel.load static method executes `pickle.loads(joblib.load(str(model_file)))` when attempting to load serialized model artifacts from disk. Because joblib and pickle inherently support the serialization of complex Python objects and execute arbitrary bytecode during the deserialization phase, supplying a specially crafted model file forces the deserialization engine to instantiate arbitrary classes and execute embedded malicious payloads.\nThe vulnerable component is the flair/models/clustering.py module, which is distributed within the official Flair wheels for versions 0.15.0 and 0.15.1. Although clustering support was officially dropped and removed from the documented API in version 0.15.0, the corresponding source file was inadvertently retained in the packaged release artifacts. Consequently, an attacker can bypass previous remediation efforts by directly importing flair.models.clustering and invoking the vulnerable loading function.\nThe attack flow proceeds as follows: First, the attacker constructs a malicious model file containing serialized Python bytecode designed to execute arbitrary system commands or payload instructions upon deserialization. Second, the attacker delivers this file to the victim or places it where the target application expects to ingest model data. Third, the victim application imports the vulnerable flair.models.clustering module and invokes ClusteringModel.load on the attacker-supplied file. Fourth, the internal call to joblib.load and subsequently pickle.loads parses the malicious payload. Finally, the Python interpreter executes the embedded instructions with the full privileges of the loading process, achieving complete system compromise without requiring authentication or specific network exposure beyond the delivery mechanism of the model file."
}