Stanza is a Stanford NLP Python library used for tokenization, sentence segmentation, NER, and parsing across many human languages. Prior to version 1.12.2, the library’s model loaders, such as stanza.models.common.pretrain.Pretrain.load(), first try to call torch.load(..., weights_only=True). If an attacker-controllable pickle.UnpicklingError occurs, the code falls back to torch.load(..., weights_only=False). This fallback path enables a malicious .pt pretrain or model file to execute arbitrary pickle code during pipeline loading. The consequence is that an attacker can run arbitrary code with the privileges of any process that loads a compromised model, and the flaw is resolved in version 1.12.2. The vulnerability is classified as CWE‑502 and CWE‑676.

The flaw affects any Stanza release prior to 1.12.2 when loading pre‑trained models via stanza.models.common.pretrain.Pretrain.load(). Users who install older versions and load models from untrusted or malicious sources are at risk.

The CVSS score of 7.5 indicates a high severity for this flaw, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be the loading of a malicious model file, which can be supplied locally or remotely if the pipeline processes user‑provided files. Successful exploitation would allow the attacker to run arbitrary code with the privileges of the process that instantiates the Stanza pipeline.