Flair

Flair versions 0.15.0 and 0.15.1 contain a persistent deserialization vulnerability in the clustering module, enabling arbitrary code execution when processing untrusted model files.