Directory Traversal Vulnerability in Stanford NLP Python Library
CVE-2026-59974

7.8HIGH

Key Information:

Vendor

Stanfordnlp

Status
Stanza
Vendor
CVE Published:
16 September 2026

What is CVE-2026-59974?

The Stanza NLP library, designed for natural language processing tasks, contains a vulnerability that allows for directory traversal during the extraction of downloaded model and resource archives. Versions prior to 1.14.0 fail to validate member paths when using zipfile.ZipFile.extractall, making it possible for attackers to exploit this flaw. Maliciously crafted archives can overwrite files outside the intended model directory, potentially leading to unauthorized code execution by manipulating configuration files, SSH data, or even executable scripts. This issue has been addressed in version 1.14.0.

Affected Version(s)

stanza < 1.14.0

References

https://github.com/stanfordnlp/stanza/security/advisories...
x_refsource_CONFIRM
https://github.com/stanfordnlp/stanza/commit/a7085e75abdf...
x_refsource_MISC
https://github.com/stanfordnlp/stanza/releases/tag/v1.14.0
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.