Skip to content
Threat Feed
Subscribe
high advisory PoC

Stanza: RCE via pickle deserialization in lemmatizer (CVE-2026-115878)

Stanza version 1.14.0 is vulnerable to remote code execution (RCE) because the lemmatizer component processes a gzip-compressed pickle stream via an unrestricted pickle.loads() call during pipeline initialization.

CVE search metadata

CVE search record: CVE-2026-115878. Severity: high. CVSS: 7.8. KEV: no. Product: Stanza 1.14.0 (< 1.15.0). Brief: Stanza: RCE via pickle deserialization in lemmatizer (CVE-2026-115878). Brief link: https://feed.craftedsignal.io/briefs/2026-11-stanza-rce-deserialization/

Triage facts

Revision 2
Applicability
Stanza 1.14.0 (< 1.15.0)
Evidence
Not observed
Severity
High
Sources
2 public sources
Freshness
Revision 2Nov 4, 00:47 UTC
Vulnerabilities
1 CVE
Source quality
B2Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    poc_available

    Changed: claim_state, has_poc, lastmod, poc_references, references, updates

    Sources: 1

Stanza version 1.14.0 contains a vulnerability where the lemmatizer component processes an embedded pickle stream without restriction. While the initial model load uses torch.load(weights_only=True), the internal dicts field (a gzip-compressed pickle) is extracted and passed to an unrestricted pickle.loads() function. An attacker supplying a crafted lemma checkpoint can execute arbitrary code with the privileges of the process loading the pipeline. This vulnerability is triggered during stanza.Pipeline construction.

Attack Mechanism

  1. Stanza's Trainer.load performs torch.load(weights_only=True). The outer weights_only check passes because the payload is hidden as bytes in the dicts field.
  2. Trainer.load invokes _unpack_pos_dict with the dicts bytes.
  3. _unpack_pos_dict decompresses the gzip stream and executes pickle.loads().
  4. Execution is confirmed end-to-end where a crafted checkpoint returning os.system via __reduce__ successfully executes the command at load time.

Impact

Successful exploitation allows for arbitrary code execution on the system running the Stanza pipeline. This occurs at initialization time before any processing or inference is performed.

Recommendation

Patch Stanza by replacing the pickle.loads() call in stanza/models/lemma/trainer.py with a restricted unpickler that only allows primitive types.