stanza vulnerabilities

3 known vulnerabilities in stanza from Stanfordnlp. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  stanza: Improper Control of Generation of Code

  CVE-2026-115878Nov 3, 2026Stanfordnlp

  Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/train

• 7.8 High severity

  stanza: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-59974Sep 16, 2026Stanfordnlp

  Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.Zip

• 7.5 High severity

  stanza: Deserialization of Untrusted Data

  CVE-2026-54499Jul 8, 2026Stanfordnlp

  Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) bu