The Snorkel library up to version 0.10.0 implements the BaseLabeler.load() method by calling Python's pickle.load on file paths supplied by the caller. Pickle deserializes objects without verifying their origin, allowing the execution of arbitrary code during unpickling. This flaw is classified as CWE‑502. A maliciously crafted pickle file, when loaded with the vulnerable method, can execute attacker provided code on the system running the library.

All installations of the Snorkel machine learning library whose version is 0.10.0 or earlier. Systems that use the BaseLabeler.load() routine to ingest pre‑trained labeler models are affected. Updating to a newer release that removes the unsafe pickle usage eliminates the vulnerability.

The vulnerability permits arbitrary code execution on the host executing the untrusted pickle file. No remote network vector is explicitly defined in the advisory, but an attacker can trigger the flaw by delivering a malicious file to any process calling BaseLabeler.load(). The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, yet the severity is high because the flaw directly leads to full system compromise.