Search
Find a vulnerability
Search criteria
4 vulnerabilities by hankcs
CVE-2026-112081 (GCVE-0-2026-112081)
Vulnerability from nvd – Published: 2026-10-19 05:15 – Updated: 2026-10-19 05:15
VLAI
EPSS
VEX
Title
hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
Summary
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421760 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421760/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112081 | third-party-advisory |
| https://vuldb.com/submit/1009708 | third-party-advisory |
| https://github.com/hankcs/HanLP/issues/1969 | issue-tracking |
| https://github.com/user-attachments/files/3291174… | exploit |
| https://github.com/hankcs/HanLP/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hankcs | HanLP |
Affected:
2.1.0-beta.0
Affected: 2.1.0-beta.1 Affected: 2.1.0-beta.2 Affected: 2.1.0-beta.3 Affected: 2.1.0-beta.4 Affected: 2.1.0-beta.5 Affected: 2.1.0-beta.6 Affected: 2.1.0-beta.7 Affected: 2.1.0-beta.8 Affected: 2.1.0-beta.9 Affected: 2.1.0-beta.10 Affected: 2.1.0-beta.11 Affected: 2.1.0-beta.12 Affected: 2.1.0-beta.13 Affected: 2.1.0-beta.14 Affected: 2.1.0-beta.15 Affected: 2.1.0-beta.16 Affected: 2.1.0-beta.17 Affected: 2.1.0-beta.18 Affected: 2.1.0-beta.19 Affected: 2.1.0-beta.20 Affected: 2.1.0-beta.21 Affected: 2.1.0-beta.22 Affected: 2.1.0-beta.23 Affected: 2.1.0-beta.24 Affected: 2.1.0-beta.25 Affected: 2.1.0-beta.26 Affected: 2.1.0-beta.27 Affected: 2.1.0-beta.28 Affected: 2.1.0-beta.29 Affected: 2.1.0-beta.30 Affected: 2.1.0-beta.31 Affected: 2.1.0-beta.32 Affected: 2.1.0-beta.33 Affected: 2.1.0-beta.34 Affected: 2.1.0-beta.35 Affected: 2.1.0-beta.36 Affected: 2.1.0-beta.37 Affected: 2.1.0-beta.38 Affected: 2.1.0-beta.39 Affected: 2.1.0-beta.40 Affected: 2.1.0-beta.41 Affected: 2.1.0-beta.42 Affected: 2.1.0-beta.43 Affected: 2.1.0-beta.44 Affected: 2.1.0-beta.45 Affected: 2.1.0-beta.46 Affected: 2.1.0-beta.47 Affected: 2.1.0-beta.48 Affected: 2.1.0-beta.49 Affected: 2.1.0-beta.50 Affected: 2.1.0-beta.51 Affected: 2.1.0-beta.52 Affected: 2.1.0-beta.53 Affected: 2.1.0-beta.54 Affected: 2.1.0-beta.55 Affected: 2.1.0-beta.56 Affected: 2.1.0-beta.57 Affected: 2.1.0-beta.58 Affected: 2.1.0-beta.59 Affected: 2.1.0-beta.60 Affected: 2.1.0-beta.61 Affected: 2.1.0-beta.62 Affected: 2.1.0-beta.63 Affected: 2.1.0-beta.64 cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:*"
],
"modules": [
"Model Config Loading"
],
"product": "HanLP",
"vendor": "hankcs",
"versions": [
{
"status": "affected",
"version": "2.1.0-beta.0"
},
{
"status": "affected",
"version": "2.1.0-beta.1"
},
{
"status": "affected",
"version": "2.1.0-beta.2"
},
{
"status": "affected",
"version": "2.1.0-beta.3"
},
{
"status": "affected",
"version": "2.1.0-beta.4"
},
{
"status": "affected",
"version": "2.1.0-beta.5"
},
{
"status": "affected",
"version": "2.1.0-beta.6"
},
{
"status": "affected",
"version": "2.1.0-beta.7"
},
{
"status": "affected",
"version": "2.1.0-beta.8"
},
{
"status": "affected",
"version": "2.1.0-beta.9"
},
{
"status": "affected",
"version": "2.1.0-beta.10"
},
{
"status": "affected",
"version": "2.1.0-beta.11"
},
{
"status": "affected",
"version": "2.1.0-beta.12"
},
{
"status": "affected",
"version": "2.1.0-beta.13"
},
{
"status": "affected",
"version": "2.1.0-beta.14"
},
{
"status": "affected",
"version": "2.1.0-beta.15"
},
{
"status": "affected",
"version": "2.1.0-beta.16"
},
{
"status": "affected",
"version": "2.1.0-beta.17"
},
{
"status": "affected",
"version": "2.1.0-beta.18"
},
{
"status": "affected",
"version": "2.1.0-beta.19"
},
{
"status": "affected",
"version": "2.1.0-beta.20"
},
{
"status": "affected",
"version": "2.1.0-beta.21"
},
{
"status": "affected",
"version": "2.1.0-beta.22"
},
{
"status": "affected",
"version": "2.1.0-beta.23"
},
{
"status": "affected",
"version": "2.1.0-beta.24"
},
{
"status": "affected",
"version": "2.1.0-beta.25"
},
{
"status": "affected",
"version": "2.1.0-beta.26"
},
{
"status": "affected",
"version": "2.1.0-beta.27"
},
{
"status": "affected",
"version": "2.1.0-beta.28"
},
{
"status": "affected",
"version": "2.1.0-beta.29"
},
{
"status": "affected",
"version": "2.1.0-beta.30"
},
{
"status": "affected",
"version": "2.1.0-beta.31"
},
{
"status": "affected",
"version": "2.1.0-beta.32"
},
{
"status": "affected",
"version": "2.1.0-beta.33"
},
{
"status": "affected",
"version": "2.1.0-beta.34"
},
{
"status": "affected",
"version": "2.1.0-beta.35"
},
{
"status": "affected",
"version": "2.1.0-beta.36"
},
{
"status": "affected",
"version": "2.1.0-beta.37"
},
{
"status": "affected",
"version": "2.1.0-beta.38"
},
{
"status": "affected",
"version": "2.1.0-beta.39"
},
{
"status": "affected",
"version": "2.1.0-beta.40"
},
{
"status": "affected",
"version": "2.1.0-beta.41"
},
{
"status": "affected",
"version": "2.1.0-beta.42"
},
{
"status": "affected",
"version": "2.1.0-beta.43"
},
{
"status": "affected",
"version": "2.1.0-beta.44"
},
{
"status": "affected",
"version": "2.1.0-beta.45"
},
{
"status": "affected",
"version": "2.1.0-beta.46"
},
{
"status": "affected",
"version": "2.1.0-beta.47"
},
{
"status": "affected",
"version": "2.1.0-beta.48"
},
{
"status": "affected",
"version": "2.1.0-beta.49"
},
{
"status": "affected",
"version": "2.1.0-beta.50"
},
{
"status": "affected",
"version": "2.1.0-beta.51"
},
{
"status": "affected",
"version": "2.1.0-beta.52"
},
{
"status": "affected",
"version": "2.1.0-beta.53"
},
{
"status": "affected",
"version": "2.1.0-beta.54"
},
{
"status": "affected",
"version": "2.1.0-beta.55"
},
{
"status": "affected",
"version": "2.1.0-beta.56"
},
{
"status": "affected",
"version": "2.1.0-beta.57"
},
{
"status": "affected",
"version": "2.1.0-beta.58"
},
{
"status": "affected",
"version": "2.1.0-beta.59"
},
{
"status": "affected",
"version": "2.1.0-beta.60"
},
{
"status": "affected",
"version": "2.1.0-beta.61"
},
{
"status": "affected",
"version": "2.1.0-beta.62"
},
{
"status": "affected",
"version": "2.1.0-beta.63"
},
{
"status": "affected",
"version": "2.1.0-beta.64"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck9 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T05:15:14.456Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421760 | hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421760"
},
{
"name": "VDB-421760 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421760/cti"
},
{
"name": "CVE-2026-112081 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112081"
},
{
"name": "Submit #1009708 | hankcs HanLP 2.1.0-beta.64 (git commit ddb1299bddff079e447af52ec12549c50636bfa8) Insecure Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009708"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/hankcs/HanLP/issues/1969"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32911743/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/hankcs/HanLP/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T16:17:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112081",
"datePublished": "2026-10-19T05:15:14.456Z",
"dateReserved": "2026-10-18T14:12:08.907Z",
"dateUpdated": "2026-10-19T05:15:14.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112079 (GCVE-0-2026-112079)
Vulnerability from nvd – Published: 2026-10-19 04:45 – Updated: 2026-10-19 16:36
VLAI
EPSS
VEX
Title
hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
Summary
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421758 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421758/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112079 | third-party-advisory |
| https://vuldb.com/submit/1009644 | third-party-advisory |
| https://github.com/hankcs/HanLP/issues/1968 | issue-tracking |
| https://github.com/user-attachments/files/3291016… | exploit |
| https://github.com/hankcs/HanLP/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hankcs | HanLP |
Affected:
2.1.0-beta.0
Affected: 2.1.0-beta.1 Affected: 2.1.0-beta.2 Affected: 2.1.0-beta.3 Affected: 2.1.0-beta.4 Affected: 2.1.0-beta.5 Affected: 2.1.0-beta.6 Affected: 2.1.0-beta.7 Affected: 2.1.0-beta.8 Affected: 2.1.0-beta.9 Affected: 2.1.0-beta.10 Affected: 2.1.0-beta.11 Affected: 2.1.0-beta.12 Affected: 2.1.0-beta.13 Affected: 2.1.0-beta.14 Affected: 2.1.0-beta.15 Affected: 2.1.0-beta.16 Affected: 2.1.0-beta.17 Affected: 2.1.0-beta.18 Affected: 2.1.0-beta.19 Affected: 2.1.0-beta.20 Affected: 2.1.0-beta.21 Affected: 2.1.0-beta.22 Affected: 2.1.0-beta.23 Affected: 2.1.0-beta.24 Affected: 2.1.0-beta.25 Affected: 2.1.0-beta.26 Affected: 2.1.0-beta.27 Affected: 2.1.0-beta.28 Affected: 2.1.0-beta.29 Affected: 2.1.0-beta.30 Affected: 2.1.0-beta.31 Affected: 2.1.0-beta.32 Affected: 2.1.0-beta.33 Affected: 2.1.0-beta.34 Affected: 2.1.0-beta.35 Affected: 2.1.0-beta.36 Affected: 2.1.0-beta.37 Affected: 2.1.0-beta.38 Affected: 2.1.0-beta.39 Affected: 2.1.0-beta.40 Affected: 2.1.0-beta.41 Affected: 2.1.0-beta.42 Affected: 2.1.0-beta.43 Affected: 2.1.0-beta.44 Affected: 2.1.0-beta.45 Affected: 2.1.0-beta.46 Affected: 2.1.0-beta.47 Affected: 2.1.0-beta.48 Affected: 2.1.0-beta.49 Affected: 2.1.0-beta.50 Affected: 2.1.0-beta.51 Affected: 2.1.0-beta.52 Affected: 2.1.0-beta.53 Affected: 2.1.0-beta.54 Affected: 2.1.0-beta.55 Affected: 2.1.0-beta.56 Affected: 2.1.0-beta.57 Affected: 2.1.0-beta.58 Affected: 2.1.0-beta.59 Affected: 2.1.0-beta.60 Affected: 2.1.0-beta.61 Affected: 2.1.0-beta.62 Affected: 2.1.0-beta.63 Affected: 2.1.0-beta.64 cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112079",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:37.189568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:33.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:*"
],
"product": "HanLP",
"vendor": "hankcs",
"versions": [
{
"status": "affected",
"version": "2.1.0-beta.0"
},
{
"status": "affected",
"version": "2.1.0-beta.1"
},
{
"status": "affected",
"version": "2.1.0-beta.2"
},
{
"status": "affected",
"version": "2.1.0-beta.3"
},
{
"status": "affected",
"version": "2.1.0-beta.4"
},
{
"status": "affected",
"version": "2.1.0-beta.5"
},
{
"status": "affected",
"version": "2.1.0-beta.6"
},
{
"status": "affected",
"version": "2.1.0-beta.7"
},
{
"status": "affected",
"version": "2.1.0-beta.8"
},
{
"status": "affected",
"version": "2.1.0-beta.9"
},
{
"status": "affected",
"version": "2.1.0-beta.10"
},
{
"status": "affected",
"version": "2.1.0-beta.11"
},
{
"status": "affected",
"version": "2.1.0-beta.12"
},
{
"status": "affected",
"version": "2.1.0-beta.13"
},
{
"status": "affected",
"version": "2.1.0-beta.14"
},
{
"status": "affected",
"version": "2.1.0-beta.15"
},
{
"status": "affected",
"version": "2.1.0-beta.16"
},
{
"status": "affected",
"version": "2.1.0-beta.17"
},
{
"status": "affected",
"version": "2.1.0-beta.18"
},
{
"status": "affected",
"version": "2.1.0-beta.19"
},
{
"status": "affected",
"version": "2.1.0-beta.20"
},
{
"status": "affected",
"version": "2.1.0-beta.21"
},
{
"status": "affected",
"version": "2.1.0-beta.22"
},
{
"status": "affected",
"version": "2.1.0-beta.23"
},
{
"status": "affected",
"version": "2.1.0-beta.24"
},
{
"status": "affected",
"version": "2.1.0-beta.25"
},
{
"status": "affected",
"version": "2.1.0-beta.26"
},
{
"status": "affected",
"version": "2.1.0-beta.27"
},
{
"status": "affected",
"version": "2.1.0-beta.28"
},
{
"status": "affected",
"version": "2.1.0-beta.29"
},
{
"status": "affected",
"version": "2.1.0-beta.30"
},
{
"status": "affected",
"version": "2.1.0-beta.31"
},
{
"status": "affected",
"version": "2.1.0-beta.32"
},
{
"status": "affected",
"version": "2.1.0-beta.33"
},
{
"status": "affected",
"version": "2.1.0-beta.34"
},
{
"status": "affected",
"version": "2.1.0-beta.35"
},
{
"status": "affected",
"version": "2.1.0-beta.36"
},
{
"status": "affected",
"version": "2.1.0-beta.37"
},
{
"status": "affected",
"version": "2.1.0-beta.38"
},
{
"status": "affected",
"version": "2.1.0-beta.39"
},
{
"status": "affected",
"version": "2.1.0-beta.40"
},
{
"status": "affected",
"version": "2.1.0-beta.41"
},
{
"status": "affected",
"version": "2.1.0-beta.42"
},
{
"status": "affected",
"version": "2.1.0-beta.43"
},
{
"status": "affected",
"version": "2.1.0-beta.44"
},
{
"status": "affected",
"version": "2.1.0-beta.45"
},
{
"status": "affected",
"version": "2.1.0-beta.46"
},
{
"status": "affected",
"version": "2.1.0-beta.47"
},
{
"status": "affected",
"version": "2.1.0-beta.48"
},
{
"status": "affected",
"version": "2.1.0-beta.49"
},
{
"status": "affected",
"version": "2.1.0-beta.50"
},
{
"status": "affected",
"version": "2.1.0-beta.51"
},
{
"status": "affected",
"version": "2.1.0-beta.52"
},
{
"status": "affected",
"version": "2.1.0-beta.53"
},
{
"status": "affected",
"version": "2.1.0-beta.54"
},
{
"status": "affected",
"version": "2.1.0-beta.55"
},
{
"status": "affected",
"version": "2.1.0-beta.56"
},
{
"status": "affected",
"version": "2.1.0-beta.57"
},
{
"status": "affected",
"version": "2.1.0-beta.58"
},
{
"status": "affected",
"version": "2.1.0-beta.59"
},
{
"status": "affected",
"version": "2.1.0-beta.60"
},
{
"status": "affected",
"version": "2.1.0-beta.61"
},
{
"status": "affected",
"version": "2.1.0-beta.62"
},
{
"status": "affected",
"version": "2.1.0-beta.63"
},
{
"status": "affected",
"version": "2.1.0-beta.64"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck9 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T04:45:08.929Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421758 | hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421758"
},
{
"name": "VDB-421758 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421758/cti"
},
{
"name": "CVE-2026-112079 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112079"
},
{
"name": "Submit #1009644 | hankcs HanLP commit ddb1299bddff079e447af52ec12549c50636bfa8 (2.1.0-beta.64) Insecure Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009644"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/hankcs/HanLP/issues/1968"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32910161/hanlp-ddb1299-vocab-pickle-poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/hankcs/HanLP/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T16:11:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112079",
"datePublished": "2026-10-19T04:45:08.929Z",
"dateReserved": "2026-10-18T14:05:59.370Z",
"dateUpdated": "2026-10-19T16:36:33.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112081 (GCVE-0-2026-112081)
Vulnerability from cvelistv5 – Published: 2026-10-19 05:15 – Updated: 2026-10-19 05:15
VLAI
EPSS
VEX
Title
hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
Summary
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421760 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421760/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112081 | third-party-advisory |
| https://vuldb.com/submit/1009708 | third-party-advisory |
| https://github.com/hankcs/HanLP/issues/1969 | issue-tracking |
| https://github.com/user-attachments/files/3291174… | exploit |
| https://github.com/hankcs/HanLP/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hankcs | HanLP |
Affected:
2.1.0-beta.0
Affected: 2.1.0-beta.1 Affected: 2.1.0-beta.2 Affected: 2.1.0-beta.3 Affected: 2.1.0-beta.4 Affected: 2.1.0-beta.5 Affected: 2.1.0-beta.6 Affected: 2.1.0-beta.7 Affected: 2.1.0-beta.8 Affected: 2.1.0-beta.9 Affected: 2.1.0-beta.10 Affected: 2.1.0-beta.11 Affected: 2.1.0-beta.12 Affected: 2.1.0-beta.13 Affected: 2.1.0-beta.14 Affected: 2.1.0-beta.15 Affected: 2.1.0-beta.16 Affected: 2.1.0-beta.17 Affected: 2.1.0-beta.18 Affected: 2.1.0-beta.19 Affected: 2.1.0-beta.20 Affected: 2.1.0-beta.21 Affected: 2.1.0-beta.22 Affected: 2.1.0-beta.23 Affected: 2.1.0-beta.24 Affected: 2.1.0-beta.25 Affected: 2.1.0-beta.26 Affected: 2.1.0-beta.27 Affected: 2.1.0-beta.28 Affected: 2.1.0-beta.29 Affected: 2.1.0-beta.30 Affected: 2.1.0-beta.31 Affected: 2.1.0-beta.32 Affected: 2.1.0-beta.33 Affected: 2.1.0-beta.34 Affected: 2.1.0-beta.35 Affected: 2.1.0-beta.36 Affected: 2.1.0-beta.37 Affected: 2.1.0-beta.38 Affected: 2.1.0-beta.39 Affected: 2.1.0-beta.40 Affected: 2.1.0-beta.41 Affected: 2.1.0-beta.42 Affected: 2.1.0-beta.43 Affected: 2.1.0-beta.44 Affected: 2.1.0-beta.45 Affected: 2.1.0-beta.46 Affected: 2.1.0-beta.47 Affected: 2.1.0-beta.48 Affected: 2.1.0-beta.49 Affected: 2.1.0-beta.50 Affected: 2.1.0-beta.51 Affected: 2.1.0-beta.52 Affected: 2.1.0-beta.53 Affected: 2.1.0-beta.54 Affected: 2.1.0-beta.55 Affected: 2.1.0-beta.56 Affected: 2.1.0-beta.57 Affected: 2.1.0-beta.58 Affected: 2.1.0-beta.59 Affected: 2.1.0-beta.60 Affected: 2.1.0-beta.61 Affected: 2.1.0-beta.62 Affected: 2.1.0-beta.63 Affected: 2.1.0-beta.64 cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:*"
],
"modules": [
"Model Config Loading"
],
"product": "HanLP",
"vendor": "hankcs",
"versions": [
{
"status": "affected",
"version": "2.1.0-beta.0"
},
{
"status": "affected",
"version": "2.1.0-beta.1"
},
{
"status": "affected",
"version": "2.1.0-beta.2"
},
{
"status": "affected",
"version": "2.1.0-beta.3"
},
{
"status": "affected",
"version": "2.1.0-beta.4"
},
{
"status": "affected",
"version": "2.1.0-beta.5"
},
{
"status": "affected",
"version": "2.1.0-beta.6"
},
{
"status": "affected",
"version": "2.1.0-beta.7"
},
{
"status": "affected",
"version": "2.1.0-beta.8"
},
{
"status": "affected",
"version": "2.1.0-beta.9"
},
{
"status": "affected",
"version": "2.1.0-beta.10"
},
{
"status": "affected",
"version": "2.1.0-beta.11"
},
{
"status": "affected",
"version": "2.1.0-beta.12"
},
{
"status": "affected",
"version": "2.1.0-beta.13"
},
{
"status": "affected",
"version": "2.1.0-beta.14"
},
{
"status": "affected",
"version": "2.1.0-beta.15"
},
{
"status": "affected",
"version": "2.1.0-beta.16"
},
{
"status": "affected",
"version": "2.1.0-beta.17"
},
{
"status": "affected",
"version": "2.1.0-beta.18"
},
{
"status": "affected",
"version": "2.1.0-beta.19"
},
{
"status": "affected",
"version": "2.1.0-beta.20"
},
{
"status": "affected",
"version": "2.1.0-beta.21"
},
{
"status": "affected",
"version": "2.1.0-beta.22"
},
{
"status": "affected",
"version": "2.1.0-beta.23"
},
{
"status": "affected",
"version": "2.1.0-beta.24"
},
{
"status": "affected",
"version": "2.1.0-beta.25"
},
{
"status": "affected",
"version": "2.1.0-beta.26"
},
{
"status": "affected",
"version": "2.1.0-beta.27"
},
{
"status": "affected",
"version": "2.1.0-beta.28"
},
{
"status": "affected",
"version": "2.1.0-beta.29"
},
{
"status": "affected",
"version": "2.1.0-beta.30"
},
{
"status": "affected",
"version": "2.1.0-beta.31"
},
{
"status": "affected",
"version": "2.1.0-beta.32"
},
{
"status": "affected",
"version": "2.1.0-beta.33"
},
{
"status": "affected",
"version": "2.1.0-beta.34"
},
{
"status": "affected",
"version": "2.1.0-beta.35"
},
{
"status": "affected",
"version": "2.1.0-beta.36"
},
{
"status": "affected",
"version": "2.1.0-beta.37"
},
{
"status": "affected",
"version": "2.1.0-beta.38"
},
{
"status": "affected",
"version": "2.1.0-beta.39"
},
{
"status": "affected",
"version": "2.1.0-beta.40"
},
{
"status": "affected",
"version": "2.1.0-beta.41"
},
{
"status": "affected",
"version": "2.1.0-beta.42"
},
{
"status": "affected",
"version": "2.1.0-beta.43"
},
{
"status": "affected",
"version": "2.1.0-beta.44"
},
{
"status": "affected",
"version": "2.1.0-beta.45"
},
{
"status": "affected",
"version": "2.1.0-beta.46"
},
{
"status": "affected",
"version": "2.1.0-beta.47"
},
{
"status": "affected",
"version": "2.1.0-beta.48"
},
{
"status": "affected",
"version": "2.1.0-beta.49"
},
{
"status": "affected",
"version": "2.1.0-beta.50"
},
{
"status": "affected",
"version": "2.1.0-beta.51"
},
{
"status": "affected",
"version": "2.1.0-beta.52"
},
{
"status": "affected",
"version": "2.1.0-beta.53"
},
{
"status": "affected",
"version": "2.1.0-beta.54"
},
{
"status": "affected",
"version": "2.1.0-beta.55"
},
{
"status": "affected",
"version": "2.1.0-beta.56"
},
{
"status": "affected",
"version": "2.1.0-beta.57"
},
{
"status": "affected",
"version": "2.1.0-beta.58"
},
{
"status": "affected",
"version": "2.1.0-beta.59"
},
{
"status": "affected",
"version": "2.1.0-beta.60"
},
{
"status": "affected",
"version": "2.1.0-beta.61"
},
{
"status": "affected",
"version": "2.1.0-beta.62"
},
{
"status": "affected",
"version": "2.1.0-beta.63"
},
{
"status": "affected",
"version": "2.1.0-beta.64"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck9 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T05:15:14.456Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421760 | hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421760"
},
{
"name": "VDB-421760 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421760/cti"
},
{
"name": "CVE-2026-112081 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112081"
},
{
"name": "Submit #1009708 | hankcs HanLP 2.1.0-beta.64 (git commit ddb1299bddff079e447af52ec12549c50636bfa8) Insecure Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009708"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/hankcs/HanLP/issues/1969"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32911743/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/hankcs/HanLP/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T16:17:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112081",
"datePublished": "2026-10-19T05:15:14.456Z",
"dateReserved": "2026-10-18T14:12:08.907Z",
"dateUpdated": "2026-10-19T05:15:14.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112079 (GCVE-0-2026-112079)
Vulnerability from cvelistv5 – Published: 2026-10-19 04:45 – Updated: 2026-10-19 16:36
VLAI
EPSS
VEX
Title
hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
Summary
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421758 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421758/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112079 | third-party-advisory |
| https://vuldb.com/submit/1009644 | third-party-advisory |
| https://github.com/hankcs/HanLP/issues/1968 | issue-tracking |
| https://github.com/user-attachments/files/3291016… | exploit |
| https://github.com/hankcs/HanLP/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hankcs | HanLP |
Affected:
2.1.0-beta.0
Affected: 2.1.0-beta.1 Affected: 2.1.0-beta.2 Affected: 2.1.0-beta.3 Affected: 2.1.0-beta.4 Affected: 2.1.0-beta.5 Affected: 2.1.0-beta.6 Affected: 2.1.0-beta.7 Affected: 2.1.0-beta.8 Affected: 2.1.0-beta.9 Affected: 2.1.0-beta.10 Affected: 2.1.0-beta.11 Affected: 2.1.0-beta.12 Affected: 2.1.0-beta.13 Affected: 2.1.0-beta.14 Affected: 2.1.0-beta.15 Affected: 2.1.0-beta.16 Affected: 2.1.0-beta.17 Affected: 2.1.0-beta.18 Affected: 2.1.0-beta.19 Affected: 2.1.0-beta.20 Affected: 2.1.0-beta.21 Affected: 2.1.0-beta.22 Affected: 2.1.0-beta.23 Affected: 2.1.0-beta.24 Affected: 2.1.0-beta.25 Affected: 2.1.0-beta.26 Affected: 2.1.0-beta.27 Affected: 2.1.0-beta.28 Affected: 2.1.0-beta.29 Affected: 2.1.0-beta.30 Affected: 2.1.0-beta.31 Affected: 2.1.0-beta.32 Affected: 2.1.0-beta.33 Affected: 2.1.0-beta.34 Affected: 2.1.0-beta.35 Affected: 2.1.0-beta.36 Affected: 2.1.0-beta.37 Affected: 2.1.0-beta.38 Affected: 2.1.0-beta.39 Affected: 2.1.0-beta.40 Affected: 2.1.0-beta.41 Affected: 2.1.0-beta.42 Affected: 2.1.0-beta.43 Affected: 2.1.0-beta.44 Affected: 2.1.0-beta.45 Affected: 2.1.0-beta.46 Affected: 2.1.0-beta.47 Affected: 2.1.0-beta.48 Affected: 2.1.0-beta.49 Affected: 2.1.0-beta.50 Affected: 2.1.0-beta.51 Affected: 2.1.0-beta.52 Affected: 2.1.0-beta.53 Affected: 2.1.0-beta.54 Affected: 2.1.0-beta.55 Affected: 2.1.0-beta.56 Affected: 2.1.0-beta.57 Affected: 2.1.0-beta.58 Affected: 2.1.0-beta.59 Affected: 2.1.0-beta.60 Affected: 2.1.0-beta.61 Affected: 2.1.0-beta.62 Affected: 2.1.0-beta.63 Affected: 2.1.0-beta.64 cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112079",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:37.189568Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:33.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:*"
],
"product": "HanLP",
"vendor": "hankcs",
"versions": [
{
"status": "affected",
"version": "2.1.0-beta.0"
},
{
"status": "affected",
"version": "2.1.0-beta.1"
},
{
"status": "affected",
"version": "2.1.0-beta.2"
},
{
"status": "affected",
"version": "2.1.0-beta.3"
},
{
"status": "affected",
"version": "2.1.0-beta.4"
},
{
"status": "affected",
"version": "2.1.0-beta.5"
},
{
"status": "affected",
"version": "2.1.0-beta.6"
},
{
"status": "affected",
"version": "2.1.0-beta.7"
},
{
"status": "affected",
"version": "2.1.0-beta.8"
},
{
"status": "affected",
"version": "2.1.0-beta.9"
},
{
"status": "affected",
"version": "2.1.0-beta.10"
},
{
"status": "affected",
"version": "2.1.0-beta.11"
},
{
"status": "affected",
"version": "2.1.0-beta.12"
},
{
"status": "affected",
"version": "2.1.0-beta.13"
},
{
"status": "affected",
"version": "2.1.0-beta.14"
},
{
"status": "affected",
"version": "2.1.0-beta.15"
},
{
"status": "affected",
"version": "2.1.0-beta.16"
},
{
"status": "affected",
"version": "2.1.0-beta.17"
},
{
"status": "affected",
"version": "2.1.0-beta.18"
},
{
"status": "affected",
"version": "2.1.0-beta.19"
},
{
"status": "affected",
"version": "2.1.0-beta.20"
},
{
"status": "affected",
"version": "2.1.0-beta.21"
},
{
"status": "affected",
"version": "2.1.0-beta.22"
},
{
"status": "affected",
"version": "2.1.0-beta.23"
},
{
"status": "affected",
"version": "2.1.0-beta.24"
},
{
"status": "affected",
"version": "2.1.0-beta.25"
},
{
"status": "affected",
"version": "2.1.0-beta.26"
},
{
"status": "affected",
"version": "2.1.0-beta.27"
},
{
"status": "affected",
"version": "2.1.0-beta.28"
},
{
"status": "affected",
"version": "2.1.0-beta.29"
},
{
"status": "affected",
"version": "2.1.0-beta.30"
},
{
"status": "affected",
"version": "2.1.0-beta.31"
},
{
"status": "affected",
"version": "2.1.0-beta.32"
},
{
"status": "affected",
"version": "2.1.0-beta.33"
},
{
"status": "affected",
"version": "2.1.0-beta.34"
},
{
"status": "affected",
"version": "2.1.0-beta.35"
},
{
"status": "affected",
"version": "2.1.0-beta.36"
},
{
"status": "affected",
"version": "2.1.0-beta.37"
},
{
"status": "affected",
"version": "2.1.0-beta.38"
},
{
"status": "affected",
"version": "2.1.0-beta.39"
},
{
"status": "affected",
"version": "2.1.0-beta.40"
},
{
"status": "affected",
"version": "2.1.0-beta.41"
},
{
"status": "affected",
"version": "2.1.0-beta.42"
},
{
"status": "affected",
"version": "2.1.0-beta.43"
},
{
"status": "affected",
"version": "2.1.0-beta.44"
},
{
"status": "affected",
"version": "2.1.0-beta.45"
},
{
"status": "affected",
"version": "2.1.0-beta.46"
},
{
"status": "affected",
"version": "2.1.0-beta.47"
},
{
"status": "affected",
"version": "2.1.0-beta.48"
},
{
"status": "affected",
"version": "2.1.0-beta.49"
},
{
"status": "affected",
"version": "2.1.0-beta.50"
},
{
"status": "affected",
"version": "2.1.0-beta.51"
},
{
"status": "affected",
"version": "2.1.0-beta.52"
},
{
"status": "affected",
"version": "2.1.0-beta.53"
},
{
"status": "affected",
"version": "2.1.0-beta.54"
},
{
"status": "affected",
"version": "2.1.0-beta.55"
},
{
"status": "affected",
"version": "2.1.0-beta.56"
},
{
"status": "affected",
"version": "2.1.0-beta.57"
},
{
"status": "affected",
"version": "2.1.0-beta.58"
},
{
"status": "affected",
"version": "2.1.0-beta.59"
},
{
"status": "affected",
"version": "2.1.0-beta.60"
},
{
"status": "affected",
"version": "2.1.0-beta.61"
},
{
"status": "affected",
"version": "2.1.0-beta.62"
},
{
"status": "affected",
"version": "2.1.0-beta.63"
},
{
"status": "affected",
"version": "2.1.0-beta.64"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "r1ck9 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T04:45:08.929Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421758 | hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421758"
},
{
"name": "VDB-421758 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421758/cti"
},
{
"name": "CVE-2026-112079 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112079"
},
{
"name": "Submit #1009644 | hankcs HanLP commit ddb1299bddff079e447af52ec12549c50636bfa8 (2.1.0-beta.64) Insecure Deserialization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009644"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/hankcs/HanLP/issues/1968"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/32910161/hanlp-ddb1299-vocab-pickle-poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/hankcs/HanLP/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T16:11:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112079",
"datePublished": "2026-10-19T04:45:08.929Z",
"dateReserved": "2026-10-18T14:05:59.370Z",
"dateUpdated": "2026-10-19T16:36:33.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}