Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, named‑entity recognition, and parsing across many languages. In versions before 1.12.2, the model loader stanza.models.common.pretrain.Pretrain.load() calls torch.load with weights_only=True, but if an attacker‑controlled pickle.UnpicklingError occurs, it falls back to torch.load with weights_only=False. This allows a malicious .pt pretrain or model file to execute arbitrary pickle code during pipeline loading. The vulnerability results in remote code execution by the user running the pipeline and is fixed in version 1.12.2, classified as CWE‑502 and CWE‑676.

The flaw affects any Stanza release prior to 1.12.2 when loading pre‑trained models via stanza.models.common.pretrain.Pretrain.load(). Users who install older versions and load models from untrusted or malicious sources are at risk.

The CVSS score of 7.5 indicates a high severity for this flaw, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be the loading of a malicious model file, which can be supplied locally or remotely if the pipeline processes user‑provided files. Successful exploitation would allow the attacker to run arbitrary code with the privileges of the process that instantiates the Stanza pipeline.