Arbitrary Code Execution in Stanza NLP Library

Compliance Impact

CVE-2026-54499 is a remote code execution vulnerability in the Stanza NLP library that allows an attacker to execute arbitrary code by loading a malicious model file. Successful exploitation can lead to credential theft, data exfiltration, or persistent backdoors.

Such impacts can compromise the confidentiality, integrity, and availability of data processed by systems using the vulnerable Stanza versions. This poses significant risks to compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access and breaches.

Therefore, if an organization uses affected versions of Stanza in environments handling regulated data, this vulnerability could lead to non-compliance due to potential data breaches and unauthorized data access.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Stanford NLP Python library called Stanza, specifically in versions prior to 1.12.2. The issue occurs when Stanza model loaders, such as stanza.models.common.pretrain.Pretrain.load(), try to load model files using torch.load with the weights_only=True option. If this attempt fails due to a pickle.UnpicklingError, the loader falls back to using torch.load with weights_only=False on a file that can be controlled by an attacker. This fallback allows a malicious .pt pretrain or model file to execute arbitrary code through Python's pickle mechanism when the Stanza NLP pipeline loads it.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to execute arbitrary code on the system running the Stanza NLP pipeline. Since the malicious code is executed during the loading of a crafted model file, an attacker could potentially take control of the affected system, leading to data compromise, system disruption, or further exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the Stanza library to version 1.12.2 or later, where the issue is fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises when Stanza NLP library versions prior to 1.12.2 load malicious .pt pretrain or model files that trigger unsafe pickle deserialization. Detection involves identifying if your system is running Stanza versions 1.12.1 or earlier and if any untrusted or suspicious .pt model files are being loaded by the Stanza pipeline.

There are no specific commands provided in the available resources to detect exploitation attempts or scan for malicious files directly. However, you can check your installed Stanza version with the following Python command:

• python -c "import stanza; print(stanza.__version__)"

To detect potentially malicious model files, you can audit the locations where Stanza loads models (e.g., model directories or caches) for unexpected or untrusted .pt files. Monitoring file changes or unexpected network activity related to model downloads may also help.

Since the vulnerability involves unsafe deserialization fallback, ensuring that your environment uses Stanza version 1.12.2 or later is the primary mitigation and detection step.

Useful 0 Not Useful 0