A risky method used in this repo may cause deserialization vulnerability

[ShellaTutko62]

Hi, @Lundez, I'd like to report that a potentially risky method is being used in this project, which may pose deserialization threats. Please check the following code example:

• main.py

from flair.models import SequenceTagger
···
def load_flair_model():
    tagger = SequenceTagger.load("londogard/flair-swe-ner")

Issue Description

As shown above, in the main.py file, the file "londogard/flair-swe-ner" is downloaded and loaded by the the SequenceTagger.load method in flair library which use torch.load as the core loading function.

This method in the Flair library is not secure because it disables the default safety parameter of torch.load. If a malicious model is loaded, the system could be infected immediately without any protection.

This model has been flagged as risky on the HuggingFace platform. Specifically, its pytorch_model.bin file is marked as malicious and may trigger deserialization threats. Once model is load, the vulnerability could be activated.

Related Risk Reports: torch.load

Suggested Repair Methods

1. Convert the model to safer safetensors format and re-upload
2. Remove the suspicious modules in the executable code of the suspicious files and re-upload them
3. Try using the torch.load method from PyTorch 2.6 or later to load the model weights. If it loads successfully, then there should be no issues.

As one popular opensource machine learning projects, every potential risk could be propagated and amplified. Could you please address the above issues?

Thanks for your help~

Best regards,
Shella

[Lundez]

Hi, I am aware of the issues. But as this model is owned by me and the library is also owned by me it's a very minor issue. Additionally this code isn't really used by anyone.

But I'll see if I can get it fixed. Feel free to do a PR!