{"id":"CVE-2026-115878","title":"Stanza: RCE via pickle deserialization in the lemmatizer","summary":"Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because st…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-94","CWE-502"],"vendor":"stanfordnlp","product":"stanza","affected":["stanza = 1.14.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T22:36:42.446948Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:39:36.547Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115878","references":[{"url":"https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5","label":"https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"},{"url":"https://github.com/stanfordnlp/stanza/pull/1649","label":"https://github.com/stanfordnlp/stanza/pull/1649"},{"url":"https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0","label":"https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0"},{"url":"https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0","label":"https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"},{"url":"https://github.com/stanfordnlp/stanza"},{"url":"https://github.com/advisories/GHSA-gh9r-c94j-cmp5"}],"tags":["cve.org","osv","pip","ghsa"],"epss":0.00597,"epssPercentile":0.48705,"aliases":["GHSA-gh9r-c94j-cmp5"],"ecosystem":"pip","patched":["stanza 1.15.0"],"ingestedAt":"2026-11-03T20:54:32.444Z","slug":"CVE-2026-115878","body":"## Overview\n\nStanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.\n\n## Affected\n\n- `stanza = 1.14.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-115878)\n\nAffected packages:\n\n- `stanza >= 1.14.0, < 1.15.0`\n\nPatched in:\n\n- `stanza 1.15.0`\n\nSource: https://osv.dev/vulnerability/GHSA-gh9r-c94j-cmp5","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}