CVE-2026-59974

HighCVSS 7.8/10Last modified Sep 30, 2026

Description

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths, and the vulnerable extraction path is reachable through stanza.download and stanza.install_corenlp. A malicious archive containing parent-directory traversal entries can write outside the intended model directory, allowing files writable by the Stanza process to be overwritten and potentially enabling code execution through modified shell configuration, SSH authorization data, Python packages, or executable scripts. This issue is fixed in version 1.14.0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-599768.1ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to c CVE-2026-599778.1ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without C CVE-2026-59985.3A flaw has been found in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects the function dispatch of the file agent/memory/servic CVE-2026-599806.3hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on CVE-2026-599817.1OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In vers CVE-2026-599827.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599835.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599845.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599855.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599899.2Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep b CVE-2026-59996.3A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such m CVE-2026-599907.5Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth