CVE-2026-76843

Name of the Vulnerable Software and Affected Versions Flair versions 0.15.0 through 0.15.1

Description An issue exists in the flair/models/clustering.py file where the ClusteringModel.load() static method uses pickle.loads() on a file loaded via joblib.load(). This allows for the execution of arbitrary Python code when a maliciously crafted model file is loaded, granting the attacker the privileges of the process performing the load.

Recommendations For versions 0.15.0 through 0.15.1, avoid importing flair.models.clustering and do not use the ClusteringModel.load() function to load untrusted model files.