Skip to content
Threat Feed
Subscribe

Vendor

Stanford NLP

1 brief RSS
high advisory

Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Stanza, an NLP library, is vulnerable to remote code execution (CVE-2026-54499) due to an unsafe fallback mechanism when loading PyTorch model files, allowing an attacker who can place a malicious pretrain or model file to achieve arbitrary code execution on systems processing NLP pipelines, leading to credential theft, backdoors, data exfiltration, and lateral movement.

Stanza +1 deserialization rce python pytorch machine-learning supply-chain cwe-502 nlp +1
2r 2t