CVE-2026-76843 Overview
CVE-2026-76843 is an insecure deserialization vulnerability in the Flair natural language processing library versions 0.15.0 and 0.15.1. The official Flair wheels ship flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))). Loading an attacker-supplied model file executes arbitrary Python code with the privileges of the loading process. This is the same sink and file as CVE-2024-10073, which recorded 0.15.0 as the fixed version because clustering support was dropped. The module was removed from the documented API but remains present in the distributed artifact and reachable via import flair.models.clustering.
Critical Impact
Loading an untrusted Flair clustering model file results in arbitrary code execution as the user running the Python process, enabling full compromise of the host environment.
Affected Products
- Flair NLP version 0.15.0 (PyPI wheel)
- Flair NLP version 0.15.1 (PyPI wheel)
- Any application importing flair.models.clustering from the distributed package
Discovery Timeline
- 2026-08-24 - CVE-2026-76843 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-76843
Vulnerability Analysis
The vulnerability is an insecure deserialization flaw classified under [CWE-502]. The ClusteringModel.load static method loads a serialized model with joblib.load and then passes the result to pickle.loads. Python's pickle module executes arbitrary code contained in specially crafted serialized objects via the __reduce__ protocol. Any attacker who controls the model file supplied to the loader gains code execution.
CVE-2024-10073 previously tracked the same code path and was marked fixed in 0.15.0 based on the removal of clustering from the documented public API. However, flair/models/clustering.py remains present in the wheels published to PyPI for both 0.15.0 and 0.15.1. Consumers who import the module by its fully qualified path bypass the API-level deprecation and reach the vulnerable sink directly.
Root Cause
The root cause is trust placed in serialized model files. The ClusteringModel.load implementation deserializes attacker-controllable input using pickle, which is documented as unsafe for untrusted data. Removing the class from the documented API did not remove the code from the shipped artifact, so the sink remains reachable.
Attack Vector
Exploitation requires a user or automated workflow to load a malicious clustering model file. Delivery channels include model repositories, shared research artifacts, community model hubs, and email or messaging attachments. The attacker crafts a pickle payload whose __reduce__ method returns a callable such as os.system with an arbitrary command. When ClusteringModel.load deserializes the file, that command executes in the context of the loading process. The attack is local in that it requires the victim to trigger the load, but the payload itself is delivered remotely.
See the Vulncheck advisory on Flair deserialization and the Flair NLP clustering module source for the vulnerable code path.
Detection Methods for CVE-2026-76843
Indicators of Compromise
- Python processes spawning unexpected child processes such as sh, bash, cmd.exe, powershell.exe, or curl shortly after invoking Flair model loading.
- Presence of flair/models/clustering.py in installed Flair 0.15.0 or 0.15.1 site-packages directories.
- Outbound network connections from Python interpreter processes to unfamiliar hosts immediately following a model load operation.
- Model files sourced from untrusted repositories with unusually large pickle sections or embedded shell commands.
Detection Strategies
- Inspect Python dependency manifests and lock files for flair==0.15.0 or flair==0.15.1 across development, CI, and production hosts.
- Static-scan pickle files for opcodes such as GLOBAL, REDUCE, and imports of os, subprocess, posix, or builtins before loading.
- Instrument Python runtimes to log invocations of pickle.loads and joblib.load in ML pipelines and correlate with subsequent process activity.
- Alert on Flair processes writing to autostart locations, cron, systemd units, or SSH authorized_keys.
Monitoring Recommendations
- Enable process-lineage telemetry on ML training and inference hosts to capture Python parent-child relationships.
- Monitor egress from data-science workstations and model-serving nodes for connections initiated by Python interpreters.
- Track file integrity on directories containing shared model artifacts and flag new or replaced files.
How to Mitigate CVE-2026-76843
Immediate Actions Required
- Audit environments for Flair 0.15.0 and 0.15.1 installations and remove or pin to a fixed release once available.
- Restrict model-loading workflows to trusted, cryptographically verified sources only.
- Block or quarantine clustering model files received from external parties until they have been reviewed.
- Run ML workloads under least-privilege service accounts with no interactive shell access or write access to sensitive paths.
Patch Information
No fixed version is identified in the NVD record at the time of publication. The earlier CVE-2024-10073 record listed 0.15.0 as fixed, but the clustering.py module remains in the shipped wheel for 0.15.0 and 0.15.1. Monitor the Flair NLP repository and the PyPI Flair package page for a release that removes the vulnerable file from distribution or replaces the pickle-based loader with a safe format.
Workarounds
- Delete flair/models/clustering.py from installed site-packages to prevent import of the vulnerable module.
- Refuse to load any Flair clustering model file whose provenance cannot be attested via signature or trusted hash.
- Execute model-loading code in a sandboxed container with no network access, read-only filesystem, and seccomp restrictions on execve.
- Replace pickle-based model persistence with formats such as safetensors where feasible for the workflow.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
