Well documentedThree or more independent publishers report the core facts.
Code injection in flair ClusteringModel.load (CVE-2024-10073)
A code injection vulnerability exists in the ClusteringModel class in flair's clustering.py file. An attacker can execute arbitrary code by loading a malicious model file through the load() function, which does not validate the model data before loading.
AII-1002-487033 sources ↓
What happened
In flair Release 0.14.0, the ClusteringModel class in flair/models/clustering.py declares a load function on line 72 that loads model data without security validation.
A researcher demonstrated that a malicious model file can trigger command execution when loaded through the ClusteringModel.load() function.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.