{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/stanza-1.14.0--1.15.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-115878"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-115878\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Stanza 1.14.0 (\u003c 1.15.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eStanza version 1.14.0 contains a vulnerability where the lemmatizer component processes an embedded pickle stream without restriction. While the initial model load uses \u003ccode\u003etorch.load(weights_only=True)\u003c/code\u003e, the internal \u003ccode\u003edicts\u003c/code\u003e field (a gzip-compressed pickle) is extracted and passed to an unrestricted \u003ccode\u003epickle.loads()\u003c/code\u003e function. An attacker supplying a crafted lemma checkpoint can execute arbitrary code with the privileges of the process loading the pipeline. This vulnerability is triggered during \u003ccode\u003estanza.Pipeline\u003c/code\u003e construction.\u003c/p\u003e\n\u003ch2 id=\"attack-mechanism\"\u003eAttack Mechanism\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eStanza's \u003ccode\u003eTrainer.load\u003c/code\u003e performs \u003ccode\u003etorch.load(weights_only=True)\u003c/code\u003e. The outer \u003ccode\u003eweights_only\u003c/code\u003e check passes because the payload is hidden as \u003ccode\u003ebytes\u003c/code\u003e in the \u003ccode\u003edicts\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eTrainer.load\u003c/code\u003e invokes \u003ccode\u003e_unpack_pos_dict\u003c/code\u003e with the \u003ccode\u003edicts\u003c/code\u003e bytes.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e_unpack_pos_dict\u003c/code\u003e decompresses the gzip stream and executes \u003ccode\u003epickle.loads()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eExecution is confirmed end-to-end where a crafted checkpoint returning \u003ccode\u003eos.system\u003c/code\u003e via \u003ccode\u003e__reduce__\u003c/code\u003e successfully executes the command at load time.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the system running the Stanza pipeline. This occurs at initialization time before any processing or inference is performed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePatch Stanza by replacing the \u003ccode\u003epickle.loads()\u003c/code\u003e call in \u003ccode\u003estanza/models/lemma/trainer.py\u003c/code\u003e with a restricted unpickler that only allows primitive types.\u003c/p\u003e\n","date_modified":"2026-11-04T00:47:14Z","date_published":"2026-11-03T22:15:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-stanza-rce-deserialization/","summary":"Stanza version 1.14.0 is vulnerable to remote code execution (RCE) because the lemmatizer component processes a gzip-compressed pickle stream via an unrestricted pickle.loads() call during pipeline initialization.","title":"Stanza: RCE via pickle deserialization in lemmatizer (CVE-2026-115878)","url":"https://feed.craftedsignal.io/briefs/2026-11-stanza-rce-deserialization/"}],"language":"en","title":"CraftedSignal Threat Feed - Stanza 1.14.0 (\u003c 1.15.0)","version":"https://jsonfeed.org/version/1.1"}