CVE-2026-59974: Stanza: Zip Slip Path Traversal in Model/Resource Extraction
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths, and the vulnerable extraction path is reachable through stanza.download and stanza.installcorenlp. A malicious archive containing parent-directory traversal entries can write outside the intended model directory, allowing files writable by the Stanza process to be overwritten and potentially enabling code execution through modified shell configuration, SSH authorization data, Python packages, or executable scripts. This issue is fixed in version 1.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stanzato a version that resolves this vulnerability.Fixed in 1.14.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Stanza versions before 1.14.0 are exposed when they use stanza.download or stanza.install_corenlp to extract a malicious downloaded model or resource archive. The impact is limited to files that the Stanza process has permission to write.
What does an attacker need to exploit it?
An attacker needs a malicious ZIP archive to reach the vulnerable Stanza extraction path. The archive must contain path-traversal entries that cause extraction outside the intended model directory.
Are default download and installation workflows affected?
Yes. The vulnerable unzip function is reachable through both stanza.download and stanza.install_corenlp, which are Stanza download and installation workflows.
What is the remediation?
Upgrade Stanza to version 1.14.0, which fixes the archive member path validation issue. If upgrading cannot happen immediately, avoid extracting untrusted model or resource archives through the affected Stanza functions and run Stanza with minimal filesystem write permissions.