{"data":{"id":"07eccfe5-d1d5-4133-aa35-05bd62e42c1d","title":"CVE-2026-54499: Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human…","summary":"CVE-2026-54499 affects Stanza, the Stanford NLP Python library, before version 1.12.2. Model loaders such as stanza.models.common.pretrain.Pretrain.load() call torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) when a pickle.UnpicklingError is raised. An attacker-controlled malicious .pt pretrain or model file can therefore execute arbitrary pickle code when a Stanza NLP pipeline loads it.","solution":"Fixed in 1.12.2.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54499","publishedAt":"2026-07-08T23:16:54.690Z","cveId":"CVE-2026-54499","cweIds":["CWE-502","CWE-676"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["stanza@<= 1.12.1 (fixed: 1.12.2)"],"affectedPackageNames":["stanza"],"affectedPackageRefs":["pypi:stanza"],"affectedVendors":[],"affectedVendorsRaw":["Stanza","Stanford NLP","PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Stanza model loaders arbitrary code execution via malicious pickle files","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00519,"epssCheckedAt":"2026-10-14T18:05:59.662Z","kevDateAdded":null,"advisoryAliases":["GHSA-v5jw-96jm-7h2c"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:54.363Z","patchAvailable":true,"disclosureDate":"2026-07-08T23:16:54.690Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"]}}