{"data":{"id":"31d2afae-68dd-4b1b-8298-5cf49d946e44","title":"CVE-2026-112081: A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file…","summary":"CVE-2026-112081 affects hankcs HanLP up to 2.1.0-beta.64, specifically the function hanlp.load in plugins/hanlp_common/hanlp_common/reflection.py within the Model Config Loading component. Manipulation of the classpath argument causes deserialization and can be triggered remotely. The exploit has been publicly disclosed, and the project was informed through an issue report but has not yet responded.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112081","publishedAt":"2026-10-19T06:17:22.430Z","cveId":"CVE-2026-112081","cweIds":["CWE-20","CWE-502"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["HanLP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"hankcs HanLP deserialization through classpath in hanlp.load","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-19T12:09:18.081Z","kevDateAdded":null,"advisoryAliases":["GHSA-g4wc-qgxw-hw24"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-19T12:09:21.246Z","patchAvailable":null,"disclosureDate":"2026-10-19T06:17:22.430Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}