CVE-2026-3071

Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.

More information : https://www.hiddenlayer.com/sai-security-advisory/2026-02-flair