The flaw arises because the ClusteringModel.load method in flair/models/clustering.py performs a pickle load on data read from a supplied model file. Pickle is inherently capable of executing arbitrary Python code, so an attacker who supplies a crafted model file can cause the loading process to execute malicious code with the same privileges as that process. Consequently, this vulnerability allows an attacker to run arbitrary code on the target system, fully compromising confidentiality, integrity, and availability. The weakness is a classic deserialization issue (CWE‑502).

The vulnerability affects the flairNLP:flair product, specifically the 0.15.0 and 0.15.1 releases. The problematic module remains in the distributed wheels, even though it was removed from the official API in 0.15.0. Admins installing these releases need to be aware that the clustering functionality persists and can be invoked by importing flair.models.clustering directly.

The CVSS base score is 8.4, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely to be an attacker-controlled model file loaded by an application using flair. If a system imports or executes the ClusteringModel.load function on an untrusted file, the attacker’s code runs with the privileges of the loading process. The risk is significant for any environment where flair is used to deserialize model files from external sources.