CVE-2026-54499: Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human language

Stanza, a Stanford library for processing human language in Python, had a vulnerability where loading malicious model files could allow attackers to run arbitrary code on a user's computer. The problem occurred because the library would try a secure loading method first, but if that failed, it would fall back to an unsafe method that could execute malicious instructions hidden in pickle (a Python format for storing data).