The vulnerability in stanza (before 1.14.0) arises because stanza.resources.common.unzip uses zipfile.ZipFile.extractall without validating the paths of archive members. This allows a specially crafted archive containing parent-directory traversal entries to write files outside the intended extraction directory. The extraction functions reachable via stanza.download and stanza.install_corenlp are affected. Exploitation can overwrite files writable by the stanza process, potentially enabling code execution through altered shell configuration files, SSH authorization data, Python packages, or executable scripts. The vendor fixed this issue in stanza version 1.14.0.

An attacker who can supply a malicious archive to stanza's download or install functions can overwrite arbitrary files writable by the stanza process. This can lead to high impact outcomes including code execution, data corruption, or privilege escalation depending on what files are overwritten. The CVSS 3.1 score is 7.8 (high), reflecting the local attack vector, low complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts.

Upgrade stanza to version 1.14.0 or later, where this path traversal vulnerability is fixed. Until then, avoid using stanza.download or stanza.install_corenlp with untrusted archives. There is no indication of alternative mitigations or temporary fixes.