Flair’s Pickle RCE Was Fixed in 0.15.0, But the File Still Ships

A CVE published on Monday records that the official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose model-loading path returns pickle.loads(joblib.load(...)). This is the same sink, in the same file, as a CVE from 2024 — which lists 0.15.0 as the fixed version.

What "fixed" meant

Clustering support was dropped in 0.15.0 — from the documented API. It was not removed from the distributed artifact. The module is still in the wheel and is reachable by importing flair.models.clustering directly. The new advisory says it plainly: "the earlier record's fixed version does not hold for the shipped package."

What the conventional framing gets wrong

The trap here is not in the code, it is in the metadata. "Fixed in 0.15.0" in a CVE record was taken to mean the code left the package; it meant the maintainers stopped supporting the feature. Anyone whose software-composition-analysis scanner reads the 2024 record's fixed-version field marks a 0.15.1 install clean. It is not clean. The second misreading runs the other way, toward alarm: the scores are 8.4 and 7.8 HIGH but the vector is local — AV:L with user interaction required. The victim has to load an attacker-supplied model file. This is an untrusted-weights supply-chain problem, not a network RCE, and reporting the 8.4 without the vector overstates it badly. Both scores are Secondary; NVD has published no primary CVSS.

The dates that make it worse

Flair 0.15.0 was uploaded to PyPI on 20 December 2024. 0.15.1 followed on 5 February 2025 and has been the current release ever since — roughly 18 months during which the file has been present, the feature has been undocumented, and the ecosystem's metadata has said the issue was resolved. No fixed version exists now either.

Why this class keeps recurring

"Load a model file, run their code" is the oldest hazard in the Python ML ecosystem, and pickle is still the default serialisation under a great deal of it. What makes this instance instructive is that the failure is in the record-keeping rather than the code: a two-year-old advisory left a live sink flagged as resolved, and the automated tooling that most organisations rely on believed it.