HanLP Deserialization Vulnerability in Torch Util

Executive Summary

This vulnerability is an arbitrary code execution flaw in HanLP (version 2.1.0-beta.64) where the library deserializes untrusted pickle files without restrictions during loading of word2vec-style embedding models. When cache=True (default), HanLP loads cache files like vectors.vocab using unrestricted pickle.load operations. The vectors.vocab file can contain malicious __reduce__ gadgets that execute arbitrary code during deserialization before legitimate data is returned.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of vectors.vocab or vectors.pt files in HanLP model directories. Inspect these files for unexpected content or recent modifications. Use file integrity monitoring tools to detect unauthorized changes in model cache files.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by providing a tampered model directory containing a malicious vectors.vocab file. When loaded, this executes arbitrary commands with the victim's privileges. Users loading embedding models from untrusted sources (shared archives, cloned repos) are at risk. The attack is remote and requires no authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to the risk of arbitrary code execution. If exploited, attackers could gain unauthorized access to sensitive data processed by HanLP, leading to unauthorized data disclosure or modification. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. The lack of input validation in deserialization may result in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid loading model files from untrusted sources. Disable cache generation by setting cache=False when loading models. Manually verify the integrity of model files using SHA-256 checksums. Monitor for suspicious file writes or command executions during model loading.

Useful 0 Not Useful 0