CVE-2026-31224 describes an insecure deserialization vulnerability (CWE-502) in the snorkel library's MultitaskClassifier.load() method. The vulnerability arises because torch.load() is called without the weights_only=True parameter, which would restrict deserialization to tensor weights only. Without this restriction, the method can deserialize arbitrary Python objects from a maliciously crafted model file, enabling remote attackers to execute arbitrary code on the victim system upon loading the file.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems by providing malicious model files to the vulnerable load() method. This can lead to full compromise of the system running the vulnerable snorkel library version. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid loading untrusted model files with the vulnerable MultitaskClassifier.load() method. If possible, manually verify or modify the code to use torch.load() with weights_only=True to mitigate the risk of arbitrary code execution.