CVE-2026-112079 in HanLP
Summary
by MITRE • 10/19/2026
A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in hankcs HanLP versions up to 2.1.0-beta.64 represents a critical security flaw rooted in improper handling of serialized data within the natural language processing library. Specifically, the function load_word2vec_as_vocab_tensor located in the hanlp/utils/torch_util.py module is susceptible to unsafe deserialization when processing input arguments related to word vector vocabularies. This issue arises because the application fails to validate or sanitize the structure and content of the vectors.vocab argument before attempting to deserialize it into a PyTorch tensor object. In software development, particularly in Python environments utilizing libraries like pickle for serialization, accepting untrusted data as an input parameter without rigorous validation is a well-known anti-pattern that can lead to severe security compromises. The core technical flaw lies in the assumption that incoming vocabulary files are benign and correctly formatted, ignoring the possibility of maliciously crafted payloads embedded within standard-looking file structures.
From a classification perspective, this vulnerability aligns with CWE-502, which describes Deserialization of Untrusted Data. This category encompasses situations where an application deserializes untrusted data without sufficiently verifying that the resulting data will be valid or safe to use. The exploitation of this flaw allows for Remote Code Execution (RCE), a high-severity outcome classified under MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques such as Python execution. An attacker who can influence the vectors.vocab argument can inject malicious code that executes arbitrary commands on the host system during the deserialization process. This capability transforms what might appear to be a simple data loading operation into a potent attack vector for full system compromise, including potential lateral movement within internal networks if the affected service is exposed or part of a larger infrastructure.
The operational impact of this vulnerability is significant due to its remote exploitability and public disclosure status. Since the exploit has been disclosed to the public, automated scanning tools and malicious actors can readily identify vulnerable instances in the wild. Organizations relying on HanLP for natural language processing tasks that involve loading external word vector models are at immediate risk if they have not applied mitigations or upgraded past the affected versions. The fact that the project maintainers were informed via an issue report but had not yet responded as of the disclosure date suggests a window of exposure where users must take proactive measures to secure their environments. This lack of immediate patch availability places the burden on system administrators and developers to implement defensive coding practices or runtime protections until an official fix is released.
To mitigate this risk, several technical controls should be implemented immediately. The most effective long-term solution is upgrading HanLP to a version where load_word2vec_as_vocab_tensor has been patched to validate inputs strictly before deserialization. In the interim, organizations can employ input validation strategies by ensuring that only trusted sources provide vocabulary files and verifying file integrity through cryptographic hashes such as SHA-256 before processing. Additionally, deploying runtime application self-protection (RASP) solutions or network-level intrusion detection systems configured to detect patterns associated with Python pickle deserialization attacks can help block exploitation attempts. Developers should also review codebases for similar unsafe deserialization calls and replace them with safer alternatives like JSON or MessagePack where possible, thereby eliminating the attack surface entirely rather than relying solely on validation checks which may be bypassed by sophisticated attackers.