CVE-2026-54499: Stanford Stanza NLP RCE Vulnerability

CVE-2026-54499 Overview

CVE-2026-54499 is an insecure deserialization vulnerability in Stanza, the Stanford NLP Python library used for tokenization, sentence segmentation, named entity recognition (NER), and parsing across many human languages. Versions prior to 1.12.2 attempt to load model files with torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) when an attacker-controllable pickle.UnpicklingError is raised. A malicious .pt pretrain or model file can execute arbitrary pickle code when a Stanza NLP pipeline loads it. The issue is tracked under [CWE-502] and fixed in version 1.12.2.

Critical Impact
A crafted Stanza model file can trigger arbitrary Python code execution in the process loading it, compromising confidentiality, integrity, and availability of downstream NLP applications.

Affected Products

Stanza (stanfordnlp/stanza) versions prior to 1.12.2
Applications loading untrusted Stanza pretrain or model .pt files
Downstream NLP pipelines invoking stanza.models.common.pretrain.Pretrain.load()

Discovery Timeline

2026-07-08 - CVE-2026-54499 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-54499

Vulnerability Analysis

Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() invoke PyTorch's torch.load() to deserialize pretrain and checkpoint files. The safe mode weights_only=True restricts unpickling to a small set of trusted types. However, the loaders wrap this call in a try/except block that catches pickle.UnpicklingError and retries with weights_only=False. That fallback restores full pickle semantics, which allows an attacker who supplies a crafted .pt file to control the exception path and cause arbitrary code execution during deserialization.

Root Cause

The root cause is trust placed in the exception raised during deserialization. Because UnpicklingError is itself attacker-controllable through the byte layout of a malicious pickle stream, an adversary can steer execution into the unsafe fallback. This defeats the protection weights_only=True was designed to provide and reintroduces classic pickle code execution semantics.

Attack Vector

Exploitation requires a victim to load an attacker-supplied Stanza model or pretrain file. Common delivery paths include third-party model hubs, community pipelines, shared research artifacts, and supply chain compromises of model repositories. When the file is loaded, embedded pickle opcodes such as __reduce__ payloads execute in the Python process running Stanza.

python

# Patch: stanza/models/classifiers/trainer.py
# Source: https://github.com/stanfordnlp/stanza/commit/b745008c68c9e50ccb5acd537cb6f2453f8b7ad4
            try:
                checkpoint = torch.load(filename, lambda storage, loc: storage, weights_only=True)
            except UnpicklingError as e:
                raise UnpicklingError("Unpickling %s failed.  If this is because it is an older model that needs weights_only=False, please convert it with a Stanza version 1.12.1 or earlier by loading and then saving." % filename) from e

The fix removes the unsafe fallback and re-raises UnpicklingError so that legacy models must be re-saved with a supported format instead of being silently loaded with full pickle semantics.

Detection Methods for CVE-2026-54499

Indicators of Compromise

Stanza processes spawning unexpected child processes such as shells, curl, wget, or Python subprocesses immediately after model load.
Outbound network connections initiated by Python interpreters that host Stanza pipelines during model initialization.
.pt files downloaded from untrusted sources or altered checksums on existing pretrain files.
Presence of Stanza versions 1.12.1 or earlier in production Python environments.

Detection Strategies

Inventory installed Python packages and flag any stanza distribution with version below 1.12.2.
Monitor process lineage where the parent is a Python interpreter loading Stanza models and the child performs shell, network, or filesystem operations.
Apply file integrity monitoring to directories containing .pt model artifacts and compare hashes against known-good releases.

Monitoring Recommendations

Alert on torch.load invocations paired with weights_only=False in application telemetry or code scanning.
Log and review all model downloads from external hubs, capturing URL, hash, and requesting user.
Correlate Python process activity with egress traffic to detect post-deserialization command and control behavior.

How to Mitigate CVE-2026-54499

Immediate Actions Required

Upgrade Stanza to version 1.12.2 or later in all environments that load NLP models.
Audit and remove any .pt model files obtained from untrusted or unverified sources.
Restrict model loading to signed or hash-verified artifacts distributed through internal channels.
Run Stanza pipelines under least-privilege service accounts without broad filesystem or network access.

Patch Information

The vulnerability is fixed in Stanza 1.12.2. The patch removes all code paths that fall back to weights_only=False when UnpicklingError is raised. Details are available in the GitHub Security Advisory GHSA-v5jw-96jm-7h2c, Pull Request #1587, the fix commit b745008c, and the v1.12.2 release notes.

Workarounds

If upgrading is not immediately possible, load Stanza models only from trusted internal repositories with verified hashes.
Isolate Stanza processes in containers or sandboxes with no outbound network access and read-only filesystems.
Re-save legacy models with a current Stanza version so they load cleanly under weights_only=True semantics.

bash

# Upgrade Stanza to the patched release
pip install --upgrade "stanza>=1.12.2"

# Verify installed version
python -c "import stanza; print(stanza.__version__)"