Read the docs
TI-2026-42766 Aliases CVE-2026-59974

Stanza: Zip Slip Path Traversal in Model/Resource Extraction

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths, and the vulnerable extraction path is reachable through stanza.download and stanza.install_corenlp. A malicious archive containing parent-directory traversal entries can write outside the intended model directory, allowing files writable by the Stanza process to be overwritten and potentially enabling code execution through modified shell configuration, SSH authorization data, Python packages, or executable scripts. This issue is fixed in version 1.14.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00405 34th percentileScored 2026-11-07
Fix Fixed stanza (stanfordnlp): 1.14.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stanfordnlpstanzabefore 1.14.01.14.0Patch availableCNA
  • stanza Vendorstanfordnlp Affected before 1.14.0 Fixed in 1.14.0 Patch available CNA

Remediation

  • Fix · CNA stanza (stanfordnlp) Fixed in 1.14.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59974

References

Other 3

  • TI-2023-20254 stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2022-00175 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp CVSS 3.1CRITICAL 9.8
  • TI-2026-39345 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders CVSS 3.1HIGH 7.5
  • TI-2021-02801 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp CVSS 3.1CRITICAL 9.8
  • TI-2021-20146 An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in… CVSS 3.1CRITICAL 9.8
  • TI-2026-84566 Pickle deserialization in Stanza lemmatizer allows code execution CVSS 3.1HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences