The Snorkel library up to version 0.10.0 implements the BaseLabeler.load() method by calling Python's pickle.load on file paths supplied by the caller. Pickle deserializes objects without verifying their origin, allowing the execution of arbitrary code during unpickling. This flaw is classified as CWE‑502. A maliciously crafted pickle file, when loaded with the vulnerable method, can execute attacker provided code on the system running the library.

All installations of the Snorkel machine learning library whose version is 0.10.0 or earlier. Systems that use the BaseLabeler.load() routine to ingest pre‑trained labeler models are affected. Updating to a newer release that removes the unsafe pickle usage eliminates the vulnerability.

The vulnerability permits arbitrary code execution on the host executing the untrusted pickle file. No remote network vector is explicitly defined in the advisory, but an attacker can trigger the flaw by delivering a malicious file to any process calling BaseLabeler.load(). The CVSS score of 8.8 indicates a high severity, and the EPSS score of < 1% shows a low current exploitation likelihood. The issue is not listed in CISA’s KEV catalog, yet the flaw directly leads to full system compromise.