CVE-2026-115878: 
Python vulnerability analysis and mitigation

CVE-2026-115878 is a remote code execution vulnerability in Stanford NLP's Stanza Python library caused by unsafe pickle deserialization in the lemmatizer checkpoint loading path. Affecting only version 1.14.0, the flaw allows an attacker who can supply or influence a lemmatizer checkpoint file to execute arbitrary code as the user loading the model. The vulnerability was published on October 1, 2026, and patched in version 1.15.0. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Github Advisory).

The root cause is deserialization of untrusted data (CWE-502) combined with improper code generation control (CWE-94). Since version 1.14.0, Stanza's lemmatizer stores pos_dict as gzip-compressed pickle bytes in the checkpoint's dicts field. When Trainer.load calls torch.load(..., weights_only=True), PyTorch's allowlist treats the bytes value as a primitive and passes it through uninspected; the inner stream is then fed directly to an unrestricted pickle.loads call in _unpack_pos_dict (trainer.py line 378). This path is reachable via the documented API — stanza.Pipeline(..., lemma_model_path=<attacker_path>) — and triggers at pipeline construction time, before any inference input is processed. No checksum validation is applied to caller-supplied checkpoint paths (GitHub Advisory).

Successful exploitation results in arbitrary code execution with the privileges of the process loading the checkpoint, yielding high confidentiality, integrity, and availability impact. An attacker can read sensitive data accessible to the loading user, modify or delete files, and disrupt service availability. Because the trigger occurs at pipeline construction rather than during inference, any application that accepts a user-controlled lemma_model_path is vulnerable even before processing any NLP input (GitHub Advisory, Github Advisory).

A minimal, runnable proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating arbitrary command execution via a crafted .pt checkpoint file (GitHub Advisory). Exploitation requires local access and user interaction (the victim must load the malicious checkpoint), but no privileges are required. The EPSS score is 0.0 and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the time of reporting (Github Advisory). No threat actor attribution has been identified.

1. Craft the malicious payload: Define a Python class with a __reduce__ method that returns (os.system, ("<command>",)), so that unpickling the object executes an arbitrary shell command.
2. Serialize and compress the payload: Serialize the payload object with pickle.dumps(Payload(), protocol=4) and compress it using gzip.GzipFile, mirroring the internal _pack_pos_dict format used by Stanza 1.14.0.
3. Build a malicious checkpoint: Construct a checkpoint dictionary {"dicts": <gzip_bytes>, "dicts_version": _DICTS_VERSION_POS} and save it as a .pt file using torch.save(..., _use_new_zipfile_serialization=False).
4. Deliver the checkpoint to the victim: Host or share the malicious evil_lemma.pt file and convince the victim to load it — for example, by supplying it as the lemma_model_path argument to stanza.Pipeline().
5. Trigger deserialization: When the victim calls stanza.Pipeline(lang=..., processors="tokenize,pos,lemma", lemma_model_path="evil_lemma.pt"), the pipeline construction calls Trainer.load → _unpack_pos_dict, which runs pickle.loads on the inner stream, executing the attacker's command with the victim's privileges (GitHub Advisory).

• File System: Unexpected files created in system temp directories (e.g., /tmp/stanza_lemma_poc_pwned or similar marker files); presence of unfamiliar .pt files in model directories not matching official Stanza model checksums.
• Process: Unusual child processes spawned by the Python interpreter running Stanza (e.g., /bin/sh, bash, curl, wget, python) at pipeline construction time rather than during inference.
• Logs: Python tracebacks or unexpected output during stanza.Pipeline() initialization referencing trainer.py, _unpack_pos_dict, or pickle.loads; application logs showing lemma_model_path set to an external or user-supplied path.
• Network: Outbound connections from the Stanza process to unexpected external hosts immediately after pipeline construction, which may indicate a reverse shell or data exfiltration payload (GitHub Advisory).

Upgrade Stanza to version 1.15.0 or later, which replaces pickle-based lemmatizer serialization with orjson, eliminating the unsafe deserialization path entirely (Stanza v1.15.0, Fix Commit). If upgrading immediately is not possible, only load lemmatizer checkpoints from trusted, verified sources and never accept lemma_model_path values from untrusted users or shared repositories. Existing v2 (pickle-format) checkpoint files can be converted to the safe v3 (JSON) format using the provided convert_lemma_dict.py utility script included in the repository (Fix PR).

The vulnerability was reported by researcher lexdotdev and patched by the Stanza maintainer AngledLuffa, who merged the fix (PR #1649) on July 31, 2026, replacing pickle with orjson for lemmatizer serialization (Fix PR). The advisory notes this is distinct from CVE-2026-54499, which addressed a separate weights_only=False issue. Threat intelligence aggregators including Radar Offseq and VulDB indexed the vulnerability shortly after disclosure, and Tenable added a cloud security plugin for detection (GitHub Advisory).