CVE-2026-115878

    Dashboard / Vulnerabilities / CVE-2026-115878

    CVE-2026-115878

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: Stanza: RCE via pickle deserialization in the lemmatizer

    Details: Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.

    References: https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115878.json, https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5, https://nvd.nist.gov/vuln/detail/CVE-2026-115878, https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0, https://github.com/stanfordnlp/stanza/pull/1649

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 1f4bfdd2bff400969444cf9f290d402448c9d6d5
    Fixed -b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0

    Affected versions

    = 1.14.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-115878 | CVE-DB