CVE-2026-3071

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-26 · updated 2026-06-17
Weakness: CWE-502

Description

Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.

Affected products

Flair: from 0.4.1

References

https://www.hiddenlayer.com/sai-security-advisory/2026-02-flair
https://www.hiddenlayer.com/sai-security-advisory/2026-02-flair

Get alerted when CVE-2026-3071 or the next vulnerability affects your stack