Arbitrary Code Execution Vulnerability in Stanza Python Library by Stanford NLP
CVE-2026-115878
Key Information:
- Vendor
Stanfordnlp
- Status
- Vendor
- CVE Published:
- 3 November 2026
Badges
What is CVE-2026-115878?
The Stanza library, a powerful NLP tool developed by Stanford, is exposed to an arbitrary code execution vulnerability. This flaw arises from the way the library handles lemmatizer checkpoints. Specifically, in versions prior to 1.15.0, an attacker could supply a malicious lemmatizer checkpoint, resulting in the execution of arbitrary code through the improper handling of gzip-compressed pickle bytes. The vulnerability exists because the library decompresses these bytes without sufficient validation, allowing for potential exploitation during the pipeline construction phase. This security issue has been addressed in version 1.15.0, and users are encouraged to upgrade to mitigate risks.
Affected Version(s)
stanza = 1.14.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.