Description
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Deserialization vulnerability
Action: Upgrade Immediately
AI Analysis

Impact

The flaw lies in hanlp.load, which accepts a classpath argument that can be manipulated. This manipulation causes deserialization of arbitrary object data. The issue is present in all HanLP releases up to 2.1.0-beta.64 and falls under CWE-20 and CWE-502.

Affected Systems

The vulnerability affects Hankcs’ HanLP library, specifically the hanlp.load function in reflection.py, for all releases up to and including 2.1.0‑beta.64. No impact is known for later versions unless they retain the same implementation.

Risk and Exploitability

The CVSS base score is 5.3, indicating a moderate level of severity. The EPSS is currently unavailable, but the description confirms that the vulnerability can be triggered remotely, which increases the likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation yet, though public proof‑of‑concept code is available.

Generated by OpenCVE AI on October 19, 2026 at 06:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade HanLP to a patched version that removes the vulnerable hanlp.load implementation.
  • If an upgrade cannot be applied immediately, restrict the classpath argument to a trusted set of directories or disable hanlp.load when processing external input until the patch is applied.
  • Implement input validation to reject unexpected or malicious classpaths, mitigating the underlying CWE-20 weakness.
  • Monitor application logs for deserialization activity and consider using runtime application security monitoring to detect exploitation attempts.

Generated by OpenCVE AI on October 19, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
First Time appeared Hankcs
Hankcs hanlp
Weaknesses CWE-20
CWE-502
CPEs cpe:2.3:a:hankcs:hanlp:*:*:*:*:*:*:*:*
Vendors & Products Hankcs
Hankcs hanlp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hankcs Hanlp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T05:15:14.456Z

Reserved: 2026-10-18T14:12:08.907Z

Link: CVE-2026-112081

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T06:17:22.430

Modified: 2026-10-19T06:17:22.430

Link: CVE-2026-112081

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T07:00:13Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-502

    Deserialization of Untrusted Data