By weakness (CWE)

CWE-676: related vulnerabilities

CVEs classified under CWE-676. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-54499HIGH 7.5

  Stanza, Stanford's popular NLP library for Python, contains a code execution vulnerability in versions before 1.12.2. When loading pre-trained language models (such as tokenization or named entity recognition models), the library attempts a safe loading mode first but falls back to an unsafe mode when it encounters certain errors. An attacker can craft a malicious model file (.pt format) that exploits this fallback behavior to run arbitrary code on a user's machine during the normal process of loading a language model. The vulnerability requires user interaction—someone must attempt to load the malicious model—but no special privileges or network access are required beyond hosting or distributing the bad model file.