A deserialization flaw exists in the `pyod.utils.persistence.load()` function within the `pyod/utils/persistence.py` file. The issue occurs because `joblib.load()` is executed before any envelope validation, allowing a remote attacker to trigger arbitrary code execution by manipulating the `path` argument to load an untrusted model file. This specifically impacts machine learning pipelines that load models from user uploads, shared folders, or registries.