CVE-2026-54499: Stanza NLP Arbitrary Code Execution via Malicious Model Files

Technical summary

Stanza's model loading functions, including stanza.models.common.pretrain.Pretrain.load(), invoke torch.load() with weights_only=True to restrict deserialization to tensors and other safe objects. However, when torch.load() raises a pickle.UnpicklingError (which an attacker can trigger by crafting the .pt file appropriately), the code catches this exception and retries with weights_only=False. This unsafe fallback disables PyTorch's protections and permits arbitrary Python code execution through pickle gadgets embedded in the model file. The vulnerability stems from treating an attacker-controllable exception as a benign error rather than a security boundary violation. Root cause is classified under CWE-502 (Deserialization of Untrusted Data) and CWE-676 (Use of Potentially Dangerous Function).

Business impact

Organizations using Stanza for NLP tasks face direct code execution risk when loading models from untrusted or compromised sources. Supply chain scenarios are particularly concerning: if model repositories, training pipelines, or internal model stores are compromised, end users unknowingly download and execute malicious code. This could lead to data theft, lateral movement within networks, ransomware deployment, or credential harvesting. The impact is severe for teams using Stanza in production systems, data processing pipelines, or research workflows that integrate third-party models. Remediation is straightforward (upgrade to 1.12.2), but discovery depends on visibility into which systems run Stanza and from which sources models are obtained.

Affected systems

Stanza versions prior to 1.12.2 are vulnerable. The risk applies wherever Stanza is installed and used to load .pt model files, particularly in Python environments used for NLP tasks, data science workflows, machine learning inference systems, and research platforms. Both direct usage (via stanza.download() or manual model loading) and indirect inclusion (as a dependency in larger NLP pipelines) present risk. Unaffected: Stanza 1.12.2 and later.

Exploitability

Exploitability is moderate in complexity but high in impact. An attacker must craft a valid .pt file containing pickle bytecode that triggers the fallback condition—this requires understanding PyTorch's serialization format and the specific error handling in Stanza. However, once created, the malicious model is easy to distribute. The attack requires user interaction (loading the model), but that is routine behavior; users do not normally inspect .pt files before loading. Network access is not required; the attacker needs only to influence model distribution (compromised repository, phishing, compromised CI/CD, or malicious dependency). CVSS 7.5 (HIGH) reflects this: network-reachable delivery, user interaction required, but no privileges needed and complete impact on confidentiality, integrity, and availability once code executes.

Remediation

Immediate action: upgrade Stanza to version 1.12.2 or later. This version removes the unsafe fallback and enforces safe deserialization throughout. Organizations should: (1) identify all systems running Stanza via dependency scanning, (2) prioritize systems that load external or untrusted models, (3) update via pip or conda (verify against official Stanford Stanza repository), and (4) validate that model loading works post-upgrade (the fix is behavioral, not a breaking API change). For organizations unable to upgrade immediately, restrict model loading to known-safe, locally-stored models with integrity verification (e.g., SHA-256 hashing of .pt files).

Patch guidance

Upgrade to Stanza version 1.12.2 or later. Installation: `pip install --upgrade stanza>=1.12.2` or update via conda if used. Verification: confirm installed version with `python -c 'import stanza; print(stanza.__version__)'`. No code changes are required; the fix is internal to the library's model loading logic. Test after upgrade by running existing NLP pipelines to ensure model loading functions normally. Consult the official Stanza GitHub repository (https://github.com/stanfordnlp/stanza) for release notes and any additional guidance.

Detection guidance

Monitor for: (1) Unexpected execution of Python subprocesses or system commands during NLP model loading operations, (2) Stanza processes spawning shells or making unusual network connections, (3) Deployment of models from unexpected sources or unsigned repositories, (4) Spike in model loading errors in logs (may indicate attempted exploitation). Implement: inventory of installed Stanza versions via package manager audits or Software Composition Analysis (SCA) tools, source integrity checks for model files (hash verification, GPG signatures if available), and network segmentation to limit data exfiltration from systems running Stanza. Log all model loads and their source to enable post-incident forensics.

Why prioritize this

This vulnerability earns HIGH priority for any organization using Stanza in production or research environments. The combination of effortless patch availability (1.12.2), high severity (code execution), and moderate exploitability (requires malicious model but no authentication) justifies rapid upgrade. Prioritize highest: systems loading models from external sources (public repositories, cloud model zoos, user-supplied data). Secondary priority: research environments and development systems that may load experimental models. If Stanza is a transitive dependency, verify that dependent projects support the new version before upgrading to avoid breakage.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) is driven by: (1) Network-adjacent attack vector (AV:N)—models can be distributed widely, (2) High attack complexity (AC:H)—attacker must craft a malicious .pt file and trigger the specific error path, (3) No privileges required (PR:N), (4) User interaction required (UI:R)—user must load the model, (5) Complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H)—arbitrary code execution permits full system compromise. The score reflects realistic threat: not trivial to execute, but devastating if successful and models are routinely loaded from semi-trusted sources.

Frequently asked questions