Stanza vulnerabilities

In the Stanza Stanford NLP Python library, versions 1.14.0 through 1.15.0 allow loading an attacker-supplied lemmatizer checkpoint to execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The path is reachable during pipeline construction through a caller-influenced lemma_model_path before inference begins.

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip passes downloaded archives to zipfile.ZipFile.extractall without validating member paths, allowing a malicious archive with parent-directory traversal entries to write outside the intended model directory and potentially enable code execution. This issue is fixed in version 1.14.0.

A vulnerability in the Stanza NLP library allows arbitrary code execution via a malicious .pt model file. The model loading mechanism first attempts safe torch.load with weights_only=True, but falls back to unsafe weights_only=False on an attacker-controlled pickle.UnpicklingError, enabling arbitrary code execution when the model is loaded.