Stanza is a Stanford NLP Python library that offers tokenization, sentence segmentation, NER, and parsing for many languages. Versions 1.14.0 through 1.15.0 contain a flaw in the lemmatizer checkpoint loading routine: the library decompresses gzip‑compressed pickle data into a byte stream and passes that stream directly to pickle.loads, enabling an attacker who can supply a malicious lemmatizer checkpoint to execute arbitrary Python code. The vulnerability is a classic deserialization flaw (CWE‑502) compounded by the execution of code via bytecode injection (CWE‑94).

The affected product is the Stanford NLP Stanza Python library. Any environment that installs Stanza 1.14.0, 1.14.1, or 1.15.0 (or any intermediate release) and constructs a pipeline that loads a lemmatizer model from a path supplied by an untrusted source is vulnerable. The issue is resolved in Stanza 1.15.0, so updating to this or later releases eliminates the problem.

The CVSS v3.1 score of 7.8 indicates high severity, but no EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivery of a crafted lemmatizer checkpoint to the application’s filesystem and then triggering pipeline construction via the lemma_model_path argument. Because the deserialized object is executed with the same privileges as the running process, an attacker can achieve full code execution, compromising confidentiality, integrity, and availability of the host system. The likely attack vector is a local or remote attacker who can influence the model path during pipeline setup, for example through a web API that accepts user‑provided data.