Skip to content
OpenAdvisories

Product · Stanford NLP

stanza

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.8
    CVE-2026-115878 Public exploit

    Stanza: RCE via pickle deserialization in the lemmatizer

    Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trai…

    Stanford NLP stanza stanza PyPI
  • High 7.8
    CVE-2026-59974

    Stanza: Zip Slip Path Traversal in Model/Resource Extraction

    Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.Zi…

    Stanford NLP stanza
  • High 7.5
    CVE-2026-54499

    Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

    Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) b…

    Stanford NLP stanza stanza PyPI