Product
Stanza version 1.14.0 is vulnerable to remote code execution (RCE) because the lemmatizer component processes a gzip-compressed pickle stream via an unrestricted pickle.loads() call during pipeline initialization.