{"affected":[{"product":"stanza","source":"CNA: GitHub_M","vendor":"stanfordnlp","versions":[{"status":"affected","version":"= 1.14.0"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"stanza","product":"stanza","source":"OSV GHSA-gh9r-c94j-cmp5","vendor":"","versions":[{"status":"affected","version":"1.14.0","versionType":"PyPI"},{"events":[{"introduced":"1.14.0"},{"fixed":"1.15.0"}],"status":"unknown","version":"1.14.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-115878","cwes":["CWE-94","CWE-502"],"description":"Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The outer torch.load call uses weights_only=True, but the nested bytes are treated as a primitive and are not inspected by that allowlist. The path is reachable during pipeline construction through a caller-influenced lemma_model_path, before inference begins. This issue is fixed in version 1.15.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793745576547,"publishedAt":1793737562220,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/stanfordnlp/stanza/security/advisories/GHSA-gh9r-c94j-cmp5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/stanfordnlp/stanza/pull/1649"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/stanfordnlp/stanza/commit/b21e1c9b47b4fccff21d3b0a6c0687a19410c2f0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/stanfordnlp/stanza/releases/tag/v1.15.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-gh9r-c94j-cmp5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-gh9r-c94j-cmp5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-gh9r-c94j-cmp5","text":"stanza (PyPI): OSV reports a fixed version 1.15.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gh9r-c94j-cmp5"}],"revision":"adb906a46abbabc37f23435171261efddb65ea0b2b4170eddb84b41ac71f4165","sources":[{"modifiedAt":1793745576547,"name":"CNA: GitHub_M","retrievedAt":1793748184000,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115878"},{"modifiedAt":1793738705204,"name":"OSV / GitHub Security Advisories","retrievedAt":1793740171049,"url":"https://osv.dev/vulnerability/GHSA-gh9r-c94j-cmp5"}],"ssvc":{"assessedAt":1793745402446,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Stanza: RCE via pickle deserialization in the lemmatizer","updatedAt":1793748184000}