CVE-2026-54499
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in the Stanza NLP library allows arbitrary code execution via a malicious .pt model file. The model loading mechanism first attempts safe torch.load with weights_only=True, but falls back to unsafe weights_only=False on an attacker-controlled pickle.UnpicklingError, enabling arbitrary code execution when the model is loaded.
Risk Assessment
An attacker can supply a crafted model file that, when loaded by a Stanza NLP pipeline, executes arbitrary code on the victim's system, leading to full compromise of the application or server.
Recommendation
Immediately update Stanza to version 1.12.2 or later. Avoid loading models from untrusted sources.
Other vulnerabilities in Stanza
See all- CVE-2026-115878High
In the Stanza Stanford NLP Python library, versions 1.14.0 through 1.15.0 allow loading an attacker-supplied lemmatizer checkpoint to execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The path is reachable during pipeline construction through a caller-influenced lemma_model_path before inference begins.
- CVE-2026-59974High
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip passes downloaded archives to zipfile.ZipFile.extractall without validating member paths, allowing a malicious archive with parent-directory traversal entries to write outside the intended model directory and potentially enable code execution. This issue is fixed in version 1.14.0.
Original NVD description (English source)
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or model file to execute arbitrary pickle code when a Stanza NLP pipeline loads it. This issue is fixed in version 1.12.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS