https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 06:51:58 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115878 <p>Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.</p> <p>Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115878 https://db.gcve.eu/vuln/ghsa-gh9r-c94j-cmp5 <p><strong>Affected:</strong> PyPI: stanza</p> <p>## TL;DR</p> <p>Loading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip-compressed pickle in the checkpoint&#39;s `dicts` field (a `bytes` value). `torch.load(weights_only=True)` treats `bytes` as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. `Trainer.load` then feeds those bytes to an **unrestricted `pickle.loads`**: the only bare `pickle.loads` in the tree. Result: `weights_only=True` gives no protection here, and model loading executes code.</p> <p>Confirmed end-to-end against stanza 1.14.0 / PyTorch 2.13.0 / CPython 3.13.7: a crafted checkpoint whose payload `__reduce__` returns `(os.system, (cmd,))` ran the command at load time (marker file showed `uid=501(...)`, `executed_by=...`).</p> <p>A downstream user is vulnerable whenever they build a pipeline that loads a caller-supplied lemmatizer checkpoint. i.e. `stanza.Pipeline(lang=..., processors=&#34;tokenize,pos,lemma&#34;, lemma_model_path=&#34;&lt;attacker-influenced .pt&gt;&#34;)` (or any equivalent load of an untrusted/shared lemma model through a custom registry) - since that call routes straight into `Trainer.load` -&gt; `_unpack_pos_dict` and executes the embedded pickle at construction time.</p> <p>## The vulnerable path</p> <p>`stanza/models/lemma/trainer.py`:</p> <p>```python # _pack_pos_dict (write side): pos_dict -&gt; pickle -&gt; gzip -&gt; bytes, stored under checkpoint[&#39;dicts&#39;]</p> <p>def _unpack_pos_dict(data): # line 54 buf = io.BytesI…</p> <p><strong>Affected:</strong> PyPI: stanza</p> <p>## TL;DR</p> <p>Loading an attacker-supplied lemma `.pt` runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores `pos_dict` as a gzip-compressed pickle in the checkpoint&#39;s `dicts` field (a `bytes` value). `torch.load(weights_only=True)` treats `bytes` as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. `Trainer.load` then feeds those bytes to an **unrestricted `pickle.loads`**: the only bare `pickle.loads` in the tree. Result: `weights_only=True` gives no protection here, and model loading executes code.</p> <p>Confirmed end-to-end against stanza 1.14.0 / PyTorch 2.13.0 / CPython 3.13.7: a crafted checkpoint whose payload `__reduce__` returns `(os.system, (cmd,))` ran the command at load time (marker file showed `uid=501(...)`, `executed_by=...`).</p> <p>A downstream user is vulnerable whenever they build a pipeline that loads a caller-supplied lemmatizer checkpoint. i.e. `stanza.Pipeline(lang=..., processors=&#34;tokenize,pos,lemma&#34;, lemma_model_path=&#34;&lt;attacker-influenced .pt&gt;&#34;)` (or any equivalent load of an untrusted/shared lemma model through a custom registry) - since that call routes straight into `Trainer.load` -&gt; `_unpack_pos_dict` and executes the embedded pickle at construction time.</p> <p>## The vulnerable path</p> <p>`stanza/models/lemma/trainer.py`:</p> <p>```python # _pack_pos_dict (write side): pos_dict -&gt; pickle -&gt; gzip -&gt; bytes, stored under checkpoint[&#39;dicts&#39;]</p> <p>def _unpack_pos_dict(data): # line 54 buf = io.BytesI…</p> https://db.gcve.eu/vuln/ghsa-gh9r-c94j-cmp5