CVE-2026-54499 describes a deserialization of untrusted data vulnerability (CWE-502) in the Stanford NLP library Stanza. Specifically, before version 1.12.2, Stanza's model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt to load model files using torch.load with weights_only=True, but if a pickle.UnpicklingError occurs, they fall back to torch.load with weights_only=False. This fallback allows an attacker to craft a malicious .pt pretrain or model file that executes arbitrary pickle code during loading, leading to remote code execution. The issue is resolved in Stanza version 1.12.2.

Successful exploitation allows an attacker to execute arbitrary code on the system loading a malicious Stanza model file. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.5 reflects high impact with network attack vector, high confidentiality, integrity, and availability impact, but requiring user interaction and high attack complexity.

A fix is available in Stanza version 1.12.2. Users should upgrade to version 1.12.2 or later to remediate this vulnerability. No other official remediation or temporary fix is documented. Until upgraded, avoid loading untrusted or attacker-controlled .pt model files with Stanza.