CVE-2026-112079: hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
HanLP versions up to 2.1.0-beta.64 are identified as affected. The vulnerable code is in hanlp/utils/torch_util.py.
What does exploitation require?
An attacker needs to influence the vectors.vocab argument passed to the affected function. The attack can be carried out remotely, but the vector includes user interaction as a required condition.
How urgent is remediation?
A public exploit has been disclosed, and the issue report states that the project had not responded at the time of the report. The vulnerability is rated medium severity with impacts to confidentiality, integrity, and availability.