CVE-2026-76843 in Flair
Summary
by MITRE • 08/24/2026
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that attacker's code with the privileges of the loading process. This is the same sink and the same file as CVE-2024-10073, which records 0.15.0 as the fixed version on the basis that clustering support was dropped in that release; the module was removed from the documented API but remains present in the distributed artifact and reachable by importing flair.models.clustering directly, so the earlier record's fixed version does not hold for the shipped package.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The Flair library versions 0.15.0 and 0.15.1 contain a critical security vulnerability within the clustering module that allows for arbitrary code execution through malicious model files. The root cause lies in the ClusteringModel.load static method, which is implemented to deserialize input data using pickle.loads on content loaded via joblib. This combination creates an insecure deserialization sink where untrusted Python objects are reconstructed and executed without sufficient validation or sanitization of their contents. Although version 0.15.0 was previously identified as the fixed release for CVE-2024-10073 based on the premise that clustering support had been removed from the public API, this assessment proved incomplete because the underlying source file flair/models/clustering.py remained present in the distributed package artifacts. Consequently, attackers can still import and utilize the vulnerable module directly by referencing it as flair.models.clustering, bypassing any intended restrictions imposed by the official documentation or high-level interface changes.
This vulnerability represents a classic insecure deserialization flaw where an application accepts serialized data from an untrusted source and processes it without proper integrity checks. When a user loads a model file crafted specifically to exploit this weakness, the pickle module will instantiate arbitrary Python objects during the loading process. If these malicious payloads include executable code within their _reduce_ methods or similar mechanisms, that code runs with the same privileges as the Flair application itself. This can lead to full system compromise, data exfiltration, or denial of service depending on what the attacker embeds in the serialized payload. The persistence of this flaw in versions 0.15.0 and 0.15.1 indicates a gap between documented API deprecations and actual code removal efforts within the distribution package.
From an industry standard perspective, this vulnerability aligns with CWE-502 Deserialization of Untrusted Data, which covers cases where applications deserialize untrusted data without verifying its integrity or source authenticity. It also maps to MITRE ATT&CK technique T1648 Suppressed Execution, as the clustering functionality was ostensibly removed from public view but remained accessible through direct module imports. The attack vector is classified under CWE-20 Improper Input Validation because the system fails to validate that the input model file originates from a trusted source or conforms to expected structural constraints before processing it.
To mitigate this risk, users of Flair versions 0.15.0 and 0.15.1 should immediately upgrade to a later version where the clustering module has been completely removed from the package distribution rather than merely hidden from documentation. Alternatively, if upgrading is not feasible in the short term, developers must avoid importing flair.models.clustering directly and ensure that no untrusted model files are passed to any deserialization functions within their applications. Implementing strict allow-lists for permitted modules during serialization processes can further reduce exposure to similar vulnerabilities across other components of the software stack.