CVE-2026-31222 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: May 13, 2026
snorkel - Insecure Deserialization
Published: May 12, 2026Updated: May 13, 2026Remote Exploitable
Overview
snorkel <= 0.10.0 contains an insecure deserialization vulnerability caused by unsafe use of torch.load() in Trainer.load(), letting remote attackers execute arbitrary code via crafted model files, exploit requires loading malicious model files.
Severity & Score
Severity: High
CVSS Score: 8.8
Impact
Remote attackers can execute arbitrary code on the victim's system by loading malicious model files.
Mitigation
Update to a version that enables weights_only=True in torch.load() or the latest version.
References
Related Resources
Details
- CVE ID
- CVE-2026-31222
- Severity
- High
- CVSS Score
- 8.8
- Type
- insecure_deserialization
- Status
- confirmed
CWE
- CWE-502
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H