The Snorkel library up to version 0.10.0 contains a flaw in the Trainer.load() method that uses torch.load() without the safety option weights_only=True. This omission allows the Pickle module to deserialize arbitrary Python objects, which an attacker can exploit by supplying a maliciously crafted model checkpoint. Executing Trainer.load on such a file yields arbitrary code execution on the host system, compromising confidentiality, integrity, and availability of the application.

Any deployment of the Snorkel library that uses Trainer.load() with checkpoint files, specifically versions up to and including 0.10.0. The vulnerability exists in the library itself and does not depend on external framework versions beyond the documented torch dependency.

The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the inherent nature of insecure deserialization gives this issue a high potential for exploitation. An attacker can trigger the vulnerability by providing a crafted model file to a system that unconditionally loads checkpoints. Once the malicious file is processed, the attacker gains arbitrary code execution, making this a critical risk when untrusted checkpoints are accepted.