Stanza 1.14.0 (< 1.15.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/stanza-1.14.0--1.15.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 22:15:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStanza: RCE via pickle deserialization in lemmatizer (CVE-2026-115878)https://feed.craftedsignal.io/briefs/2026-11-stanza-rce-deserialization/Tue, 03 Nov 2026 22:15:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-stanza-rce-deserialization/Stanza version 1.14.0 is vulnerable to remote code execution (RCE) because the lemmatizer component processes a gzip-compressed pickle stream via an unrestricted pickle.loads() call during pipeline initialization.Stanza version 1.14.0 contains a vulnerability where the lemmatizer component processes an embedded pickle stream without restriction. While the initial model load uses torch.load(weights_only=True), the internal dicts field (a gzip-compressed pickle) is extracted and passed to an unrestricted pickle.loads() function. An attacker supplying a crafted lemma checkpoint can execute arbitrary code with the privileges of the process loading the pipeline. This vulnerability is triggered during stanza.Pipeline construction.

Attack Mechanism

  1. Stanza's Trainer.load performs torch.load(weights_only=True). The outer weights_only check passes because the payload is hidden as bytes in the dicts field.
  2. Trainer.load invokes _unpack_pos_dict with the dicts bytes.
  3. _unpack_pos_dict decompresses the gzip stream and executes pickle.loads().
  4. Execution is confirmed end-to-end where a crafted checkpoint returning os.system via __reduce__ successfully executes the command at load time.

Impact

Successful exploitation allows for arbitrary code execution on the system running the Stanza pipeline. This occurs at initialization time before any processing or inference is performed.

Recommendation

Patch Stanza by replacing the pickle.loads() call in stanza/models/lemma/trainer.py with a restricted unpickler that only allows primitive types.

]]>highadvisory