Arbitrary Code Execution Vulnerability in Flair NLP by Zalando

CVE-2026-76843

What is CVE-2026-76843?

The Flair NLP framework versions 0.15.0 and 0.15.1 contain a vulnerability in the ClusteringModel.load method that allows attackers to execute arbitrary Python code during the loading of a malicious model file. The method leverages 'pickle' and 'joblib', posing a significant risk by running the attacker's code with the same privileges as the loading process. Even though clustering support was dropped in version 0.15.0, the vulnerable module remains present, making this a critical concern for users relying on these versions.

References