What is the CVSS score of EUVD-2026-29506?

EUVD-2026-29506 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Snorkel are affected by EUVD-2026-29506?

Snorkel machine learning library versions 0.10.0 and earlier contain an arbitrary code execution vulnerability in model checkpoint loading that could allow attackers to execute malicious code when…

How to fix or mitigate EUVD-2026-29506?

Within 24 hours: Identify all Snorkel deployments and versions in use across data science and ML infrastructure; notify teams to avoid loading model checkpoints from untrusted sources. Within 7 days: Implement code review and file-hash verification processes for all model checkpoint imports; consider temporary sandboxing of Trainer.load() operations. Within 30 days: Upgrade to Snorkel version >0.10.0 when available; if upgrade blocked, implement network segmentation isolating ML training environments and restrict model file sources to internally-controlled repositories only.

Snorkel EUVD-2026-29506

| CVE-2026-31222 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-12 mitre

GHSA-78cp-f66x-qmh5

RCE Python Deserialization N A Checkpoint

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 15:55 vuln.today

CVSS changed

May 13, 2026 - 15:52 NVD

8.8 (HIGH)

CVE Published

May 12, 2026 - 00:00 nvd

HIGH 8.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 pypi packages depend on snorkel (4 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.10.0.

DescriptionCVE.org

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() method of the Trainer class. The method loads model checkpoint files using torch.load() without enabling the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exploit this by providing a maliciously crafted model file, leading to arbitrary code execution on the victim's system when the file is loaded via the vulnerable method.

AnalysisAI

Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.

Technical ContextAI

Snorkel is a Python framework for programmatic data labeling and weak supervision in machine learning pipelines. The vulnerability resides in the interaction between Snorkel's Trainer class and PyTorch's checkpoint loading mechanism. PyTorch's torch.load() function uses Python's Pickle protocol for serialization, which can execute arbitrary code during deserialization. While PyTorch introduced the weights_only=True parameter to restrict deserialization to tensor data only, Snorkel v0.10.0 and earlier versions call torch.load() with default settings that permit full object deserialization. This creates a CWE-502 (Deserialization of Untrusted Data) vulnerability where any Python object-including those with __reduce__ methods that execute system commands-can be embedded in a model file and triggered when loaded.

RemediationAI

Upgrade to Snorkel versions newer than v0.10.0 when a patched release becomes available; monitor the official GitHub repository (https://github.com/snorkel-team/snorkel) and PyPI package updates for security releases addressing CVE-2026-31222. No vendor-released patch version is independently confirmed from available data at time of analysis. As interim compensating controls: restrict Trainer.load() usage to checkpoint files from trusted, verified sources only; implement file integrity verification using cryptographic signatures or hashes before loading any model checkpoints; apply filesystem permissions to prevent unauthorized modification of checkpoint directories; deploy application sandboxing (containers, VMs with limited privileges) to contain potential code execution if malicious models are loaded; consider patching the local Snorkel installation by modifying Trainer.load() to call torch.load() with weights_only=True, though this may break legitimate functionality if checkpoints contain non-tensor objects. Network-based controls are ineffective as exploitation occurs during local file processing. Organizations not loading third-party or user-supplied checkpoint files face minimal risk and may defer patching until operational updates.