{"id":"CVE-2026-112079","kind":"vulnerability","aliases":["CVE-2026-112079"],"related":[],"title":"HanLP: unsafe deserialization in word2vec vocab loader enables remote code","description":"A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"HanLP, a Python natural language processing library, has an unsafe deserialization flaw in its load_word2vec_as_vocab_tensor function when handling the vectors.vocab argument. A remote attacker can supply a crafted model file so that loading it runs attacker-chosen code on the machine that loads it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hanlp","ml-pipelines","package","python"],"not_affected_if":["no-word2vec-loading","trusted-models-only"],"how_to_check":"- `pip show hanlp` to read the installed version\n- Search your code and models for calls to `load_word2vec_as_vocab_tensor` or word2vec models loaded from untrusted sources","fix":"- Upgrade past `2.1.0-beta.64`; no fixed version is named in the sources\n- Load word2vec or other model files only from trusted sources until a fix is released","status":"open","published_at":"2026-10-19T05:17:04+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:22+00:00","updated_at":"2026-10-25T03:23:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:23:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade past `2.1.0-beta.64`; no fixed version is named in the sources\n- Load word2vec or other model files only from trusted sources until a fix is released","reach":"unknown","title":"HanLP: unsafe deserialization in word2vec vocab loader enables remote code","impact":"high","summary":"HanLP, a Python natural language processing library, has an unsafe deserialization flaw in its load_word2vec_as_vocab_tensor function when handling the vectors.vocab argument. A remote attacker can supply a crafted model file so that loading it runs attacker-chosen code on the machine that loads it.","category":"package","nicknames":[],"who_cares":["python","hanlp","ml-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"code runs on the server that loads the model","analyst_note":"Confirm the default load path reaching load_word2vec_as_vocab_tensor, whether an upstream fix exists, and the attack vector (the sources say remote but do not explain how the file arrives); check the NVD page and the project issue tracker.","how_to_check":"- `pip show hanlp` to read the installed version\n- Search your code and models for calls to `load_word2vec_as_vocab_tensor` or word2vec models loaded from untrusted sources","needs_analyst":true,"not_affected_if":["no-word2vec-loading","trusted-models-only"],"who_is_affected":"Teams that use HanLP up to 2.1.0-beta.64 and load word2vec vocabulary or model files, especially ones that come from outside the team. Applications that only use HanLP with their own trusted models, or that do not load word2vec vectors, are less exposed. The sources do not say which pipelines reach this function by default.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":3363,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112079':13A,16A '-2026':12A,15A '2.1.0':81C 'affect':84C 'argument':47B,102C 'attack':50B,63B,108C 'attacker-chosen':62B 'beta.64':82C 'carri':113C 'chosen':64B 'code':10A,65B 'craft':54B 'cve':11A,14A 'deseri':3A,33B,106C 'disclos':120C 'earli':135C 'element':85C 'enabl':8A 'exploit':117C 'file':56B,96C 'flaw':34B 'found':75C 'function':42B,88C 'handl':44B 'hankc':77C 'hanlp':1A,17B,23B,78C 'hanlp/utils/torch_util.py':97C 'inform':131C 'issu':138C 'languag':27B 'lead':104C 'librari':29B 'load':37B,59B,70B,89C 'loader':7A 'machin':68B 'manipul':99C 'may':125C 'ml':19B 'ml-pipelin':18B 'model':55B 'natur':26B 'packag':21B 'pipelin':20B 'possibl':110C 'problem':134C 'process':28B 'project':129C 'public':123C 'python':22B,25B 'remot':9A,49B,115C 'report':139C 'respond':143C 'run':61B 'suppli':52B 'tensor':41B,93C 'unsaf':2A,32B 'use':127C 'vectors.vocab':46B,103C 'vocab':6A,40B,92C 'vulner':72C 'word2vec':5A,38B,90C 'yet':144C","nicknames":[],"mitigations":[],"who_affected":"Teams that use HanLP up to 2.1.0-beta.64 and load word2vec vocabulary or model files, especially ones that come from outside the team. Applications that only use HanLP with their own trusted models, or that do not load word2vec vectors, are less exposed. The sources do not say which pipelines reach this function by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T05:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112079","severity":null,"published_at":"2026-10-19T05:17:04+00:00","modified_at":"2026-10-19T17:17:10+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}