Read the docs
TI-2026-84566 Aliases CVE-2026-115878GHSA-gh9r-c94j-cmp5

Pickle deserialization in Stanza lemmatizer allows code execution

Priority LOW 37CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Stanza, a Stanford NLP Python library, is affected from 1.14.0 before 1.15.0. Its lemmatizer checkpoint loader passes nested gzip-compressed pickle data to unrestricted pickle.loads, which the torch weights_only check does not inspect (CWE-502). An attacker who supplies a lemmatizer checkpoint can execute arbitrary code when a user builds a pipeline that loads it, which requires that user's interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00597 48th percentileScored 2026-11-07
Fix Fixed stanza (PyPI): 1.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stanfordnlpstanza= 1.14.0—No fix listedCNA
—stanza (PyPI)1.14.0 to before 1.15.01.15.0Patch availableGHSA-gh9r-c94j-cmp5
  • stanza Vendorstanfordnlp Affected = 1.14.0 Fixed in — No fix listed CNA
  • stanza (PyPI) Vendor— Affected 1.14.0 to before 1.15.0 Fixed in 1.15.0 Patch available GHSA-gh9r-c94j-cmp5

Remediation

Upgrade the stanza package to version 1.15.0, which fixes this issue. Versions from 1.14.0 before 1.15.0 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · GHSA-gh9r-c94j-cmp5 stanza (PyPI) Fixed in 1.15.0 Advisory →

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-115878
  2. 2026-11-03 Alias added: GHSA-gh9r-c94j-cmp5
  3. 2026-11-03 Fix available: PyPI/[email protected] · GHSA-gh9r-c94j-cmp5
  4. 2026-11-03 CVSS score added · GHSA-gh9r-c94j-cmp5
  5. 2026-11-03 Weakness changed · GHSA-gh9r-c94j-cmp5
  6. 2026-11-03 5 new references · GHSA-gh9r-c94j-cmp5
  7. 2026-11-03 CISA SSVC decision points changed
  8. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 5

  • TI-2023-20254 stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2022-00175 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp CVSS 3.1CRITICAL 9.8
  • TI-2026-42766 Stanza: Zip Slip Path Traversal in Model/Resource Extraction CVSS 3.1HIGH 7.8
  • TI-2026-39345 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders CVSS 3.1HIGH 7.5
  • TI-2021-02801 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp CVSS 3.1CRITICAL 9.8
  • TI-2021-20146 An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in… CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences