Flair NLP EUVD-2026-64849

Exploitation requires the victim process to explicitly import flair.models.clustering and call ClusteringModel.load() on a file the attacker controls - a module removed from Flair's documented API but still present and importable in the 0.15.0 and 0.15.1 PyPI wheels. The malicious model file must be accessible on the local filesystem at the time of the load call (AV:L per the CVSS 4.0 vector), which in practice means the attacker must deliver it via download, shared storage, or file transfer to the victim host before or during execution. Active interaction is required (UI:A): an automated pipeline or human operator must initiate the ClusteringModel.load() call. Exploitation is limited by: (1) the module being absent from Flair's documented API, reducing the likelihood of new code using it; (2) the mandatory local file access step, which requires a prior delivery mechanism; and (3) the absence of any network-listening component in Flair itself that could be directly targeted. Organizations that have fully audited their codebases and confirmed no calls to ClusteringModel.load() or imports of flair.models.clustering are not at direct risk from this specific path.

The CVSS 4.0 score of 8.4 reflects full system compromise potential (VC:H/VI:H/VA:H) constrained by local attack vector (AV:L) and required active user interaction (UI:A). Real-world risk is highly context-dependent: in automated ML pipelines that ingest model files from external repositories, model hubs, or shared network storage, the local-file constraint is easily satisfied during normal workflow execution, elevating practical risk significantly above what AV:L implies in a traditional software context. Exploitation is not passive or network-facing - a victim process must explicitly call ClusteringModel.load() on a reachable malicious file. The most dangerous scenario is legacy or research code that previously used ClusteringModel and was not audited after the CVE-2024-10073 'fix,' leaving teams with a false belief in remediation. EPSS data is absent from available intelligence. KEV status is not confirmed. No public exploit code has been identified, keeping realized exploitation probability currently low, but the technique (pickle deserialization) requires no novel research and is thoroughly documented.

An attacker crafts a malicious joblib-wrapped pickle payload that spawns a reverse shell or exfiltrates environment variables and credentials upon deserialization. They upload this file to a public model repository, shared NFS mount, or S3 bucket used by a target organization's ML training pipeline. When an automated training job or data scientist calls ClusteringModel.load() on the poisoned file - operating under the assumption that clustering support was safely removed in 0.15.0 - the payload executes with the OS privileges of the Python process, achieving full host compromise.