CVE-2026-115878

Name of the Vulnerable Software and Affected Versions Stanza versions 1.14.0 through 1.14.x

Description Loading a malicious lemmatizer checkpoint can lead to arbitrary code execution. The issue occurs because the unpack pos dict() function in stanza/models/lemma/trainer.py processes pos dict as gzip-compressed pickle bytes and passes the decompressed stream to an unrestricted pickle.loads() call. Although the initial torch.load call uses weights only=True, the nested bytes are treated as a primitive and bypass this security check. This path is reachable during pipeline construction when a user-influenced lemma model path is provided to stanza.Pipeline(), allowing the embedded pickle payload to execute at construction time.

Recommendations Update Stanza to version 1.15.0. As a temporary mitigation, avoid loading lemmatizer checkpoints from untrusted or caller-supplied sources via the lemma model path parameter.