CVE-2026-3071

Published: Feb 26, 2026Modified: Jun 17, 2026Deferred

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: 6f8de1f0-f67e-45a6-b68f-98777fdb759c (Secondary)

Description

Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://www.hiddenlayer.com/sai-security-advisory/2026-02-flair

Source: 6f8de1f0-f67e-45a6-b68f-98777fdb759c

https://www.hiddenlayer.com/sai-security-advisory/2026-02-flair

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.