Vulnerability · CVE-2026-115878
Stanza: RCE via pickle deserialization in the lemmatizer
Published Nov 3, 2026 · catalog updated Nov 3, 2026 · Stanza: RCE via pickle
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-115878. EPSS is 0.60%. Act only if a listed version of Stanza: RCE via pickle is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Stanza: RCE via pickle).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High7.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.60%
- Remediation
- Advisory link
- Affected products
- PyPI stanza · pip stanza · pypi stanza · vendor stanfordnlp stanza
## TL;DR Loading an attacker-supplied lemma runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores as a gzip-compressed pickle in the checkpoint's field (a value). treats as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. then feeds those bytes to an **unrestricted **: the only bare in the tree. Result: gives no protection here, and model loading executes code. Confirmed end-to-end against stanza 1.14.0 / PyTorch 2.13.0 / CPython 3.13.7: a crafted checkpoint whose payload returns ran the command at load time (marker file showed , ). A downstream user is vulnerable whenever they build a pipeline that loads a caller-supplied lemmatizer checkpoint. i.e. (or any equivalent load of an untrusted/shared lemma model through a custom registry) - since that call routes straight into -> and executes the embedded pickle at construction time. ## The vulnerable path : **Reachable from the documented API.** -> -> -> . Any shared/distributed checkpoint, custom registry, or caller-supplied reaches it. No checksum is applied to caller-supplied paths (MD5 verification exists only in the default registry download flow). Trigger is at pipeline construction, before any inference input is processed. Note: this is **not** the fallback fixed under CVE-2026-54499: the outer load stays safe; the exposure is entirely the inner pickle. ## Minimal PoC The PoC calls directly: the exact expression at . Reaching it through additionally requires the crafted file to carry a well-formed / so runs to line 378 (established by source review); the deserialization to execution step is confirmed at runtime. ## Fix Deserialize the inner stream with the the project already uses in (allowlists / / only): A legitimate is a nested string mapping no class/function globals, so it loads cleanly, while any -style payload is rejected by . JSON would work equally well (all keys/values are strings) and remove pickle from this path entirely. Apply to both
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI stanza1.14.0 → 1.15.0
- pip stanza= 1.14.0
- pypi stanzaversion unspecified
- vendor stanfordnlp stanzaversion unspecified
How to fix CVE-2026-115878
Upgrade
CVE-2026-115878 lists a fix boundary at 1.15.0. Compare the installed build with that boundary before you change production.
Version check
Seen in 1.14.0 → 1.15.0 · 1 other packages on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-115878. EPSS is 0.60%. Act only if a listed version of Stanza: RCE via pickle is installed.
Which versions are affected?
Compare what you have installed with 1.14.0 → 1.15.0, = 1.14.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-502: Deserialization of Untrusted Data; CWE-94: Code Injection. EPSS 0.60%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Nov 3, 2026 · PyPA Advisory Database
Detected
## TL;DR Loading an attacker-supplied lemma runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores as a gzip-compressed pickle in the checkpoint's field (a value). treats as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. then feeds those bytes to an **unrestricted **: the only bare in the tree. Result: gives no protection here, and
Nov 3, 2026 · PyPA Advisory Database
Fix available
stanza fixed in 1.15.0
Nov 3, 2026 · PyPA Advisory Database
Fix available
stanza fixed in 1.15.0
Nov 3, 2026 · PyPA Advisory Database
Updated
## TL;DR Loading an attacker-supplied lemma runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores as a gzip-compressed pickle in the checkpoint's field (a value). treats as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. then feeds those bytes to an **unrestricted **: the only bare in the tree. Result: gives no protection here, and
Nov 3, 2026 · CVE.org
Updated
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dict as gzip-compressed pickle bytes and Trainer.load passes the decompressed stream to unrestricted pickle.loads. The oute
Sources
- CVE.orgVulnerability recordCVE-2026-115878
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores pos_dic
cve.org - FIRST EPSSExploitation probabilityCVE-2026-115878
30-day exploitation probability 0.60%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-gh9r-c94j-cmp5
Stanza: RCE via pickle deserialization in the lemmatizer
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-115878
TL;DR Loading an attacker-supplied lemma .pt runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores pos_dict as a gzip-compressed pickle in the checkpoint's dicts field (a bytes value). torch.load(weights_only=True) treats bytes as a primitive and passes it through unexamined, so its allowlist never sees the inner stream. Trainer.load then feeds those bytes to an unrestricted
advisories.gitlab.com - PyPA Advisory DatabasePackage advisoryGHSA-gh9r-c94j-cmp5
Stanza: RCE via pickle deserialization in the lemmatizer
osv.dev
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitLab Advisory DatabaseNov 6, 2026
- GitHub Advisory DatabaseNov 6, 2026
- PyPA Advisory DatabaseNov 4, 2026
- FIRST EPSSNov 4, 2026
- CVE.orgNov 4, 2026