CVE-2026-112081: hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
HanLP deployments using versions up to 2.1.0-beta.64 are affected where an attacker can influence the classpath argument passed to hanlp.load. The issue can be initiated remotely.
What does an attacker need to exploit this issue?
The attacker needs a way to manipulate the classpath argument used by hanlp.load. No privileges are required, but user interaction is required according to the supplied severity vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified early through an issue report but had not responded.