# CVE-2026-31223: Snorkel insecure deserialization in BaseLabeler.load

Source: https://junglewise.ai/threats/cve-2026-31223-snorkel-insecure-deserialization-in-baselabeler-load  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-31223 · Severity: high · CVSS 8.8 · Published 2026-05-12

Snorkel is a Python library used by data scientists to programmatically build and manage training datasets for machine learning. A security flaw in how the library loads saved models allows a malicious actor to execute unauthorized code on a user's computer. This occurs if a user is tricked into loading a specially crafted model file, potentially leading to a full system compromise or data theft.

Technologies: [snorkel (PyPI)](https://junglewise.ai/threats/technologies/pypi-snorkel), [Snorkel](https://junglewise.ai/threats/technologies/snorkel). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Snorkel](https://junglewise.ai/threats/vendors/snorkel).

## Quick answers

**Is CVE-2026-31223 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31223 being exploited in the wild.

**How severe is CVE-2026-31223?** High severity, with a CVSS score of 8.8, published 12 May 2026.

**Which products and versions are affected?** snorkel (PyPI) ECOSYSTEM:introduced=0,last_affected=0.10.0.

**Is there a fix for CVE-2026-31223?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-31223 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-31223?** Check whether you run snorkel (PyPI) or Snorkel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Snorkel library (up to and including v0.10.0) contains an insecure deserialization vulnerability (CWE-502) within the BaseLabeler.load() method. The root cause is the use of the unsafe Python 'pickle.load()' function to process serialized labeler models from user-provided file paths without validation. Because the pickle module can instantiate arbitrary Python objects, a remote attacker can craft a malicious pickle file that executes arbitrary commands when deserialized. Exploitation requires the victim to load the malicious file, resulting in full code execution in the context of the application. As of the advisory date, no patched version has been identified.

## Affected products

- snorkel-team snorkel <= 0.10.0

## Identifiers

- CVE-2026-31223
- GHSA-fq92-qc8f-482v
- PYSEC-2026-3069

## Timeline

- 2026-05-12: advisory: NVD and GitHub Advisory published
- 2026-05-18: other: GitHub Advisory reviewed and updated

## References

- [https://github.com/snorkel-team/snorkel](https://github.com/snorkel-team/snorkel)
- [https://www.notion.so/CVE-2026-31223-35d1e1393188811ab1d0e4a8a2e67992](https://www.notion.so/CVE-2026-31223-35d1e1393188811ab1d0e4a8a2e67992)

## Related threats

- [Snorkel insecure deserialization in MultitaskClassifier](https://junglewise.ai/threats/cve-2026-31224-snorkel-insecure-deserialization-in-multitaskclassifier)
- [Snorkel insecure deserialization in Trainer.load](https://junglewise.ai/threats/cve-2026-31222-snorkel-insecure-deserialization-in-trainer-load)