By vendor

Stanford vulnerabilities

Known CVEs affecting Stanford products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-54499HIGH 7.5

  Stanza, Stanford's popular NLP library for Python, contains a code execution vulnerability in versions before 1.12.2. When loading pre-trained language models (such as tokenization or named entity recognition models), the library attempts a safe loading mode first but falls back to an unsafe mode when it encounters certain errors. An attacker can craft a malicious model file (.pt format) that exploits this fallback behavior to run arbitrary code on a user's machine during the normal process of loading a language model. The vulnerability requires user interaction—someone must attempt to load the malicious model—but no special privileges or network access are required beyond hosting or distributing the bad model file.