{"id":"CVE-2026-112081","kind":"vulnerability","aliases":["CVE-2026-112081"],"related":[],"title":"HanLP: model config loading lets a remote caller trigger deserialization","description":"A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"hanlp.load() resolves the classpath strings in a model package's JSON config with a bare importlib import and instantiates the class with attacker-chosen arguments. A crafted model package can make HanLP fetch an attacker URL and parse it with fasttext. The reporter says this is not arbitrary RCE. The PoC is public in issue #1969 and the maintainer has not responded.","severity":"medium","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hanlp","fixed":[],"affected":"<= 2.1.0-beta.64","ecosystem":"pypi"}],"ecosystems":[],"tags":["deserialization","hanlp","nlp","package","pip","python","untrusted-model"],"not_affected_if":["hardcoded-model-paths","no-user-controlled-input","official-models-only"],"how_to_check":"- Run `pip show hanlp`; versions up to 2.1.0b64 (2.1.0-beta.64) are listed as affected, and the NVD list covers beta.0 to beta.64\n- Search code for hanlp.load(...) calls where the path or model package comes from users, uploads, downloads or mirrors\n- Look in ~/.hanlp/thirdparty/ for cached files from unexpected hosts","fix":"No fixed version known: the maintainer has not responded to issue #1969 and the latest release found (v2.1.1) was not confirmed as fixed. Until then, only hanlp.load() model packages from sources you trust, and do not load model files or configs from users, chat attachments, shared folders or unofficial mirrors.","status":"open","published_at":"2026-10-19T06:17:22+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:18+00:00","updated_at":"2026-10-25T03:47:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:23:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HanLP: model config loading lets a remote caller trigger deserialization","impact":"high","summary":"HanLP's hanlp.load function, in its model config loader, deserializes an attacker-controlled classpath argument. An attacker who can influence that argument can cause unsafe deserialization, which in Python can lead to code execution.","category":"package","nicknames":[],"who_cares":["python","hanlp","nlp"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown; deserialization could allow code execution on the server","analyst_note":"Confirm the fixed version and whether untrusted input reaches classpath; check the NVD entry and the public exploit disclosure for details.","how_to_check":"- Run `pip show hanlp` and compare the installed version with the affected range (up to 2.1.0-beta.64)\n- Search your code and configs for calls to `hanlp.load` that take model names or paths from user input or remote sources","needs_analyst":true,"not_affected_if":["hardcoded-model-paths","no-user-controlled-input"],"who_is_affected":"Teams that call hanlp.load on model config or classpath values that can come from users, requests, or remote sources. Applications that only load fixed, locally bundled HanLP models with hardcoded paths are less exposed. The sources do not say which HanLP release fixes the issue, and the project had not responded at the time of the report.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3367,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether untrusted input reaches classpath; check the NVD entry and the public exploit disclosure for details.","search":"'-112081':13A,16A '-2026':12A,15A '1969':83B '2.1.0':99C 'affect':102C 'arbitrari':75B 'argument':52B,120C 'attack':50B,62B,130C 'attacker-chosen':49B 'bare':41B 'beta.64':100C 'caller':8A 'caus':122C 'chosen':51B 'class':47B 'classpath':30B,121C 'compon':112C 'config':3A,38B,114C 'craft':54B 'cve':11A,14A 'deseri':10A,18B,123C 'determin':93C 'disclos':137C 'earli':149C 'exploit':133C 'fasttext':68B 'fetch':60B 'file':108C 'function':104C 'hankc':95C 'hanlp':1A,17A,19B,59B,96C 'hanlp.load':27B,105C 'import':43B 'importlib':42B 'inform':145C 'initi':128C 'instanti':45B 'issu':82B,152C 'json':37B 'let':5A 'load':4A,115C 'maintain':86B 'make':58B 'manipul':117C 'may':139C 'model':2A,26B,34B,55B,113C 'nlp':20B 'packag':21B,35B,56B 'pars':65B 'pip':22B 'plugins/hanlp_common/hanlp_common/reflection.py':109C 'poc':78B 'possibl':126C 'problem':148C 'project':143C 'public':80B,136C 'python':23B 'rce':76B 'remot':7A,131C 'report':70B,153C 'resolv':28B 'respond':89B,157C 'say':71B 'string':31B 'trigger':9A 'untrust':25B 'untrusted-model':24B 'url':63B 'util':141C 'vulner':91C 'yet':158C","nicknames":[],"mitigations":[],"who_affected":"Teams that call hanlp.load on model config or classpath values that can come from users, requests, or remote sources. Applications that only load fixed, locally bundled HanLP models with hardcoded paths are less exposed. The sources do not say which HanLP release fixes the issue, and the project had not responded at the time of the report.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112081","severity":null,"published_at":"2026-10-19T06:17:22+00:00","modified_at":"2026-10-22T03:16:34+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112081:778","url":null,"severity":null,"published_at":"2026-10-25T03:43:34+00:00","modified_at":"2026-10-25T03:43:34+00:00","first_seen_at":"2026-10-25T03:43:34+00:00","fetched_at":"2026-10-25T03:43:34+00:00","note":"Read reporter issue hankcs/HanLP#1969 (open, unanswered, PoC attached) and NVD. Not a remote caller: victim must hanlp.load() an attacker-supplied model package; reporter says no arbitrary RCE, impact is instantiation of installed protocol-compatible classes plus attacker-URL fetch fed to fasttext.load_model. No fixed release found on primary pages; a mirror page mentioning trust_remote_code was not verified, so not used. CVSS 4.0 per CNA is 5.3 medium; kept severity high pending your call but suggest medium."}],"documents":[{"id":3306,"url":"https://github.com/hankcs/HanLP/issues/1969","title":"HanLP #1969: classpath reflection in hanlp.load (reporter 3em0)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3307,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112081","title":"NVD CVE-2026-112081","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}