CVE-2023-39020

Name of the Vulnerable Software and Affected Versions stanford-parser versions 3.9.2 and below

Description The issue is related to a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument to the getBZip2PipedInputStream function.

Recommendations For stanford-parser versions 3.9.2 and below, as a temporary workaround, consider restricting the use of the getBZip2PipedInputStream function in the edu.stanford.nlp.io component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.