CVE-2026-54499CWE-502CWE-676

Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

High · published July 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or model file to execute arbitrary pickle code when a Stanza NLP pipeline loads it. This issue is fixed in version 1.12.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00519 · 42.2th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-676 · Use of Potentially Dangerous Function
Published
2026-07-08T22:23Z
EPSS history
Timeline
  • 08 JUL 22:23Z
    Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
    cvelistv5