CVE-2026-115878

A Stanza lemmatizer checkpoint can execute code as it loads

Stanford NLP Group · Stanza lemmatizer model loader

First documented disclosure · Review checkpoint

Summary

An untrusted model file can run code in the NLP process before the first inference.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The researcher demonstrated command execution in the decoder and traced the pipeline entry point in source. No malicious use was reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The weights-only loader passes through a byte string. The lemmatizer then decompresses it and hands the contents to an unrestricted pickle decoder.

Conditions required

An application constructs a lemmatizer with an attacker-influenced checkpoint path or obtains a checkpoint from an untrusted source.

Potential impact

Payload code runs with the permissions of the account loading the model.

Affected versions and configurations

Stanza 1.14.0 is the version identified by the CNA and tested by the researcher.

Fix and mitigation status

1.15.0 replaces the nested pickle representation with orjson and rejects v2 pickle checkpoints.

Practical next steps

Upgrade to a release containing the fix, replace v2 pickle checkpoints with trusted compatible models and restrict who can supply model paths.

Operating lesson

Check every decoder a model file passes through, including data embedded as bytes inside an otherwise restricted format.

Evidence and limits

The July 30 public fix proposal identifies the unsafe lemmatizer. The October 1 release and advisory precede the November 3 CVE publication. This is distinct from the older weights-only fallback issue.

Sources