CVE-2026-31223 — Unsafe pickle.load in Snorkel BaseLabeler.load

MITRE service request: 1987825

Status: RESERVED (pending a qualifying public reference per CNA Rules §5.3).

Official CVE description

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of the BaseLabeler class. The method loads serialized labeler models using the unsafe pickle.load() function on user-supplied file paths without any validation or security controls. Python’s pickle module is inherently dangerous for deserializing untrusted data, as it can execute arbitrary code during the deserialization process. A remote attacker can exploit this by providing a maliciously crafted pickle file, leading to arbitrary code execution on the victim’s system when the file is loaded via the vulnerable method.

Summary

BaseLabeler.load(source=...) performs native pickle.load on attacker-controlled paths. Pickle is not a safe interchange format—loading untrusted .pkl is equivalent to running untrusted bytecode.

Affected product and versions

• Product: snorkel-team/snorkel.
• Affected range (coordination record): through v0.10.0 (commit 617c92400c50e95ce41fcee84309a86f76cf525c).

Technical details

• Sink: pickle.load on user source path.
• Exploit: Craft __reduce__ gadget inside pickle blob.
• Victim: Calls BaseLabeler.load inside labeling pipelines.
• Impact: Immediate RCE.

Risk

Critical — pickle is inherently executable.

Remediation / workaround

• Replace pickle with safe serialization (JSON + weights) where feasible.
• Never load pickles from untrusted origins; sandbox workloads.