Vulnerability · Published Oct 17, 2024 · Assigned by VulDB
CVE-2024-10073flairNLP flair Mode File Loader clustering.py ClusteringModel code injection
Medium 5.0
In plain English
A medium-severity code injection in flair from flairNLP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | flair | 0.15.0 | GHSA-9rw2-jf8x-cgwm |
| PyPI | flair | 0.15.0 | PYSEC-2026-1376 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- VDB-280722 | flairNLP flair Mode File Loader clustering.py ClusteringModel code injection vdb-entry, technical-description
- VDB-280722 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #420055 | flairNLP flair v0.14.0 Code Injection third-party-advisory
- https://github.com/bayuncao/vul-cve-20 related
- https://github.com/bayuncao/vul-cve-20/blob/main/PoC.py exploit