Executive brief
Stanza is a popular Python library used for natural language processing tasks like analyzing human languages and text. A security flaw in how the library loads AI models allows a malicious model file to execute unauthorized commands on a user's computer. If a researcher or developer downloads a compromised model from an untrusted source, an attacker could gain full control over their system, steal data, or access sensitive credentials.
Technical details
A deserialization vulnerability (CWE-502) exists in Stanza's model loading components, including stanza.models.common.pretrain.Pretrain.load(). While the library attempts to use PyTorch's secure 'weights_only=True' loading method, it contains a fallback mechanism that catches 'pickle.UnpicklingError' and re-attempts the load using 'weights_only=False'. An attacker can trigger this fallback by embedding an unsupported pickle global in a malicious .pt file. This results in the execution of arbitrary Python code via the pickle 'reduce' method when the model is loaded into a Stanza pipeline. The vulnerability affects multiple loaders including those for coreference resolution, classifiers, and lemmatizers. The issue is resolved in version 1.12.2 by removing the unsafe fallback paths.
Affected products
- Stanford NLP Group Stanza < 1.12.2
Timeline
- 2026-05-28: patched: Fix merged into development branch
- 2026-06-03: advisory: Version 1.12.2 released with security fix
- 2026-06-18: disclosed: GitHub Security Advisory published
- 2026-07-08: advisory: CVE-2026-54499 published to NVD