CVE-2026-31238: The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component. Whe

The Ludwig framework (a machine learning tool) versions up to 0.10.4 has a vulnerability where it unsafely loads model files using a method that can execute arbitrary code. When someone runs the ludwig serve command to host a model, an attacker can provide a malicious model file that tricks the system into running their code, potentially taking over the server.