CVE-2026-31224 - Vulnerability Analysis

Overview

Snorkel <= 0.10.0 contains an insecure deserialization vulnerability caused by unsafe use of torch.load() in MultitaskClassifier.load(), letting remote attackers execute arbitrary code via crafted model files, exploit requires malicious model file.

Severity & Score

Impact

Remote attackers can execute arbitrary code on the victim's system by loading a crafted model file.

Mitigation

Update to the latest version with secure deserialization or apply security-restrictive parameters in torch.load()

References

• https://github.com/snorkel-team/snorkel
• https://www.notion.so/CVE-2026-31224-35d1e1393188814185f3f6db86c9a4e9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner