CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
Attackers can execute arbitrary code by providing malicious model files to Stanza NLP pipelines due to unsafe pickle deserialization fallbacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54499?
CVE-2026-54499 is a high-severity unsafe deserialization vulnerability in stanfordnlp stanza, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or model file to execute arbitrary pickle code when a Stanza NLP pipeline loads it. This issue is fixed in version 1.12.2.
Which versions are affected by CVE-2026-54499?
3 open source packages ship an affected version, including stanza. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
stanza PyPI | All versions | 1.12.2 |
stanza PyPI | All versions | 1.12.2 |
stanza PyPI | All versions | 1.12.2 |
Products include Stanford Stanza.
How do I fix CVE-2026-54499?
Upgrade stanza to 1.12.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-54499 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54499 exists.
Sources
Also known as GHSA-v5jw-96jm-7h2c, PYSEC-2026-3075.