Executive brief
Snorkel is a library used by data scientists to programmatically build and manage training datasets for machine learning. A security flaw in how it loads saved models allows an attacker to execute malicious code on a user's computer. This occurs if a user is tricked into loading a specially crafted model file, potentially leading to a full system compromise or data theft.
Technical details
The Snorkel library (up to v0.10.0) contains an insecure deserialization vulnerability (CWE-502) within the Trainer.load() method. The root cause is the use of the torch.load() function without the 'weights_only=True' security parameter enabled. Because torch.load() uses the Python pickle module by default, it can be coerced into instantiating arbitrary Python objects. An attacker can exploit this by providing a maliciously crafted model checkpoint file; when a user or automated system attempts to load this file via the vulnerable method, it results in arbitrary code execution. As of the advisory date, no patched version has been identified.
Affected products
- Snorkel Team snorkel <= 0.10.0
Timeline
- 2026-05-12: disclosed: CVE-2026-31222 published
- 2026-05-12: advisory: GitHub Advisory GHSA-78cp-f66x-qmh5 published