Snorkel Library Insecure Deserialization Vulnerability in BaseLabeler Class Allowing Arbitrary Code Execution

A critical insecure deserialization vulnerability has been identified in the Snorkel library, affecting versions through 0.10.0. The issue resides in the BaseLabeler.load() method, where serialized labeler models are loaded using the unsafe pickle.load() function. This process occurs without any validation or security controls, allowing remote attackers to exploit the vulnerability by providing maliciously crafted pickle files. When these files are loaded via the vulnerable method, they can execute arbitrary code on the victim's system.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the system where the vulnerable Snorkel library is used.

Remediation

Users can upgrade to Snorkel version 0.10.1 or later to address this vulnerability.