{"data":{"id":"f8b140d8-cf66-4e32-b8d1-9d40e1f76ef3","title":"CVE-2026-59974: Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human…","summary":"Stanza, a Stanford NLP Python library, prior to 1.14.0 extracts downloaded model and resource archives in stanza/resources/common.py via zipfile.ZipFile.extractall without validating member paths. Archives reached through stanza.download and stanza.install_corenlp containing parent-directory traversal entries can write outside the model directory, overwriting files writable by the Stanza process and potentially enabling code execution through shell configuration, SSH authorization data, Python packages, or executable scripts.","solution":"Fixed in version 1.14.0.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59974","publishedAt":"2026-09-16T17:17:28.877Z","cveId":"CVE-2026-59974","cweIds":["CWE-22"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Stanza","Stanford NLP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Stanza archive extraction path traversal in unzip during model download","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00405,"epssCheckedAt":"2026-11-04T06:10:13.969Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T00:10:44.234Z","patchAvailable":null,"disclosureDate":"2026-09-16T17:17:28.877Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}