CVE-2026-59974

Name of the Vulnerable Software and Affected Versions Stanza versions prior to 1.14.0

Description The stanza.resources.common.unzip function in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall() without validating member paths. This path is reachable through stanza.download and stanza.install corenlp. A malicious archive using parent-directory traversal—a technique where special characters are used to access files and directories outside the intended folder—can overwrite files writable by the Stanza process. This could potentially lead to code execution by modifying shell configurations, SSH authorization data, Python packages, or executable scripts.

Recommendations Update to version 1.14.0.