What is the CVSS score of CVE-2026-31223?

CVE-2026-31223 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Snorkel are affected by CVE-2026-31223?

Snorkel library versions through 0.10.0 contain an arbitrary code execution vulnerability in the BaseLabeler.load() method that allows attackers to execute malicious code through crafted pickle…

How to fix or mitigate CVE-2026-31223?

Within 24 hours: Identify all systems running Snorkel library through version 0.10.0 and document their role in production workflows. Within 7 days: Implement strict file validation and access controls restricting BaseLabeler.load() to trusted internal sources only; disable external pickle file ingestion where feasible. Within 30 days: Monitor the Snorkel project repository for a patched release and establish a deployment plan; consider alternative deserialization methods or data labeling solutions if no patch timeline is communicated by the vendor.

Snorkel CVE-2026-31223

EUVD-2026-29507 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-12 mitre

GHSA-fq92-qc8f-482v

Python RCE Deserialization

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 15:55 vuln.today

CVSS changed

May 13, 2026 - 15:52 NVD

8.8 (HIGH)

CVE Published

May 12, 2026 - 00:00 nvd

HIGH 8.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 pypi packages depend on snorkel (4 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.10.0.

DescriptionCVE.org

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of the BaseLabeler class. The method loads serialized labeler models using the unsafe pickle.load() function on user-supplied file paths without any validation or security controls. Python's pickle module is inherently dangerous for deserializing untrusted data, as it can execute arbitrary code during the deserialization process. A remote attacker can exploit this by providing a maliciously crafted pickle file, leading to arbitrary code execution on the victim's system when the file is loaded via the vulnerable method.

AnalysisAI

Arbitrary code execution in Snorkel library (Python) through version 0.10.0 enables remote attackers to execute code by supplying malicious pickle files to the BaseLabeler.load() method. The vulnerability stems from unsafe deserialization using pickle.load() without input validation, allowing attackers to craft serialized objects that execute arbitrary commands during deserialization. With EPSS at 6th percentile, exploitation probability remains relatively low despite the critical CVSS score, and no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

Snorkel is a Python framework for programmatic data labeling and weak supervision in machine learning workflows. The vulnerability resides in the BaseLabeler class's load() method, which deserializes labeler model files using Python's pickle module. CWE-502 (Deserialization of Untrusted Data) represents a fundamental security anti-pattern where serialization formats with executable capabilities process untrusted input. Python's pickle protocol can invoke arbitrary callables during unpickling via __reduce__ magic methods, making it unsuitable for loading data from untrusted sources. The affected CPE is generic (cpe:2.3:a:n/a:n/a), indicating limited structured product metadata, though the snorkel-team GitHub repository is confirmed as the authoritative source for this library.

RemediationAI

Upgrade Snorkel to a patched version beyond 0.10.0 if available from the maintainers at https://github.com/snorkel-team/snorkel, monitoring the repository's releases and security advisories for fix confirmation. Upstream fix version not independently confirmed from available data at time of analysis. As immediate mitigation, restrict BaseLabeler.load() usage to only load pickle files from trusted, validated sources within controlled environments. Implement file integrity checks (cryptographic signatures/hashes) for any labeler model files before deserialization. Consider refactoring code to use safer serialization formats like JSON or Protocol Buffers for labeler persistence where architecturally feasible, though this requires code changes to the serialization logic. Isolate Snorkel execution environments using containerization with minimal privileges to limit blast radius if exploitation occurs. Disable or remove BaseLabeler.load() functionality entirely if not required for operational workflows. Note that mitigation trade-offs include reduced functionality for loading pre-trained labelers and potential workflow disruptions if model persistence is core to ML pipelines.