Executive brief
Stanza is a Python library for natural language processing tasks like text tokenization and named entity recognition. Prior to version 1.14.0, the library does not properly validate file paths when extracting downloaded model archives, allowing a malicious archive to write files outside the intended directory. An attacker could exploit this to overwrite system or application files (such as shell configuration, SSH keys, or Python packages) and potentially achieve code execution.
Technical details
The vulnerability is a "zip slip" path traversal flaw in stanza/resources/common.py where the unzip function passes downloaded archives directly to zipfile.ZipFile.extractall() without validating member paths for parent-directory traversal sequences (e.g., "../"). The vulnerability is reachable through the stanza.download() and stanza.install_corenlp() APIs, which download model archives from Stanford's repositories. An attacker controlling or intercepting the archive download could craft a malicious ZIP file with paths like "../../sensitive/file" to escape the intended model directory and overwrite files. The attack surface is limited by the fact that Stanza controls its own official resource servers, but man-in-the-middle or compromised distribution could pose risk. The issue is patched in version 1.14.0 by validating that extracted paths remain within the target directory.
Affected products
- Stanford NLP Stanza before 1.14.0
Timeline
- 2026-09-16: disclosed
- 2026-07-15: patched: Fixed in version 1.14.0