CVE-2026-31224: Snorkel

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier.load() method of the MultitaskClassifier class. The method loads model weight files using torch.load() without enabling the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted model file, leading to arbitrary code execution on the victim's system when the file is loaded via the vulnerable method.

Affected products

• Snorkel Snorkel: up to and including 0.10.0

Published 2026-05-12. Last modified 2026-06-17.