Stanza versions before 1.12.2 contain a deserialization vulnerability (CWE-502) in their model loading mechanism. When loading pretrain or model files, the library first attempts to load weights safely using torch.load with weights_only=True. If this fails due to a pickle.UnpicklingError, it falls back to torch.load with weights_only=False, which allows untrusted pickle data to be deserialized. This fallback can be exploited by an attacker supplying a malicious .pt file to execute arbitrary code during model loading. The vulnerability is resolved in Stanza 1.12.2 by removing or securing this unsafe fallback.

An attacker who can supply a malicious .pt pretrain or model file to a Stanza NLP pipeline running a vulnerable version can execute arbitrary code on the host system during model loading. This leads to full confidentiality, integrity, and availability compromise of the affected system. The vulnerability requires user interaction to load the malicious file and has a high attack complexity due to the need to bypass the initial safe load attempt.

Upgrade Stanza to version 1.12.2 or later, where this vulnerability is fixed. There is no official patch advisory text provided, but the fix is confirmed in version 1.12.2. Until upgrading, avoid loading untrusted or unauthenticated .pt pretrain or model files to prevent exploitation.