Safety vulnerability ID: 73973
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of flairNLP are vulnerable to Remote Code Execution (CWE-94) through Code Injection. An attacker can execute arbitrary code by manipulating model files loaded by ClusteringModel in flair/models/clustering.py. An attacker can craft malicious model files that, when loaded by the target application, execute arbitrary code. While exploitability requires specific conditions and is considered difficult, working exploits are publicly available. To remediate, upgrade beyond version 0.14.0 or implement strict model file validation.
Latest version: 0.14.0
A very simple framework for state-of-the-art NLP
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application