---
id: CVE-2026-115878
title: 'Stanza: RCE via pickle deserialization in the lemmatizer'
summary: >-
  Stanza is a Stanford NLP Python library for tokenization, sentence
  segmentation, NER, and parsing of many human languages. From 1.14.0 until
  1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute
  arbitrary code because st…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
  - CWE-502
vendor: stanfordnlp
product: stanza
affected:
  - stanza = 1.14.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T22:36:42.446948Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:39:36.547Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115878'
references:
  - url: >-
      https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5
    label: >-
      https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5
  - url: 'https://github.com/stanfordnlp/stanza/pull/1649'
    label: 'https://github.com/stanfordnlp/stanza/pull/1649'
  - url: >-
      https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0
    label: >-
      https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0
  - url: 'https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0'
    label: 'https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0'
  - url: 'https://github.com/stanfordnlp/stanza'
  - url: 'https://github.com/advisories/GHSA-gh9r-c94j-cmp5'
tags:
  - cve.org
  - osv
  - pip
  - ghsa
epss: 0.00597
epssPercentile: 0.48705
aliases:
  - GHSA-gh9r-c94j-cmp5
ecosystem: pip
patched:
  - stanza 1.15.0
ingestedAt: '2026-11-03T20:54:32.444Z'
---

## Overview

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.

## Affected

- `stanza = 1.14.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115878)

Affected packages:

- `stanza >= 1.14.0, < 1.15.0`

Patched in:

- `stanza 1.15.0`

Source: https://osv.dev/vulnerability/GHSA-gh9r-c94j-cmp5