CVE-2026-112079

MediumCVSS 6.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

A vulnerability has been found in hankcs HanLP in the load_word2vec_as_vocab_tensor function of hanlp/utils/torch_util.py. Manipulating the vectors.vocab argument leads to deserialization, and the attack is possible remotely. The exploit has been disclosed to the public and may be used.

Risk Assessment

Remote exploitation could lead to arbitrary code execution through unsafe deserialization, resulting in full compromise of the environment. The public availability of the exploit increases the risk.

Recommendation

Do not load untrusted model/vector files and restrict access to functions processing input data. Monitor the project for a fix and apply it once released.

Other vulnerabilities in HanLP

CVE-2026-112081Medium
A vulnerability was found in HanLP up to 2.1.0-beta.64 in the hanlp.load function of reflection.py, related to model config loading. Manipulating the classpath argument causes deserialization, enabling remote attacks. The exploit has been publicly disclosed and the project has not yet responded.

Original NVD description (English source)

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS