Remote Code Execution via Insecure Deserialization in Flair

Flair versions 0.15.0 and 0.15.1 contain a critical deserialization vulnerability (CVE-2026-76843) stemming from the inclusion of the 'flair/models/clustering.py' module in distributed Python wheels. The 'ClusteringModel.load' static method improperly utilizes 'pickle.loads(joblib.load(...))' to process model files. This behavior allows an attacker to achieve arbitrary code execution by supplying a maliciously crafted model file to an application utilizing the library. This issue persists despite earlier efforts to address similar risks in CVE-2024-10073 by removing the module from the documented API; however, the code remains present in the distribution and reachable via direct import. Defenders should treat any application utilizing Flair 0.15.0 or 0.15.1 as potentially vulnerable to remote code execution if it processes user-supplied model files.

Impact

Successful exploitation results in arbitrary code execution with the privileges of the application process. This vulnerability affects downstream systems and services that rely on the Flair library for machine learning model processing, potentially leading to full system compromise if the service runs with elevated permissions or lacks sandbox isolation.

Recommendation

• Immediately audit environments for the presence of Flair versions 0.15.0 and 0.15.1.
• Implement strict input validation and access controls for any model files ingested by applications, as native serialization formats like pickle are inherently unsafe for untrusted data.
• Upgrade to a version of Flair where the 'flair.models.clustering' module is entirely removed from the distributed artifact.
• For legacy systems that cannot be updated, implement process-level sandboxing (such as containers with minimal privileges) to isolate the execution of model loading routines.