---
id: "CVE-2026-112081"
kind: "vulnerability"
aliases: ["CVE-2026-112081"]
title: "HanLP: model config loading lets a remote caller trigger deserialization"
severity: "medium"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "hanlp", "fixed": [], "affected": "<= 2.1.0-beta.64", "ecosystem": "pypi"}]
ecosystems: []
tags: ["deserialization", "hanlp", "nlp", "package", "pip", "python", "untrusted-model"]
not_affected_if: ["hardcoded-model-paths", "no-user-controlled-input", "official-models-only"]
published_at: "2026-10-19T06:17:22+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:47:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112081", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:43:34+00:00"}]
---

# HanLP: model config loading lets a remote caller trigger deserialization

hanlp.load() resolves the classpath strings in a model package's JSON config with a bare importlib import and instantiates the class with attacker-chosen arguments. A crafted model package can make HanLP fetch an attacker URL and parse it with fasttext. The reporter says this is not arbitrary RCE. The PoC is public in issue #1969 and the maintainer has not responded.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:hanlp affected <= 2.1.0-beta.64 fixed ?

## How to check

- Run `pip show hanlp`; versions up to 2.1.0b64 (2.1.0-beta.64) are listed as affected, and the NVD list covers beta.0 to beta.64
- Search code for hanlp.load(...) calls where the path or model package comes from users, uploads, downloads or mirrors
- Look in ~/.hanlp/thirdparty/ for cached files from unexpected hosts

## Fix

No fixed version known: the maintainer has not responded to issue #1969 and the latest release found (v2.1.1) was not confirmed as fixed. Until then, only hanlp.load() model packages from sources you trust, and do not load model files or configs from users, chat attachments, shared folders or unofficial mirrors.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112081
- 2026-10-25T03:43:34+00:00 analyst — Read reporter issue hankcs/HanLP#1969 (open, unanswered, PoC attached) and NVD. Not a remote caller: victim must hanlp.load() an attacker-supplied model package; reporter says no arbitrary RCE, impact is instantiation of installed protocol-compatible classes plus attacker-URL fetch fed to fasttext.load_model. No fixed release found on primary pages; a mirror page mentioning trust_remote_code was not verified, so not used. CVSS 4.0 per CNA is 5.3 medium; kept severity high pending your call but suggest medium.

## Documents

- [advisory] NVD CVE-2026-112081 https://nvd.nist.gov/vuln/detail/CVE-2026-112081
- [poc] HanLP #1969: classpath reflection in hanlp.load (reporter 3em0) https://github.com/hankcs/HanLP/issues/1969

## From the sources

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_