CVE-2026-112081 in HanLP
Summary
by MITRE • 10/19/2026
A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in hankcs HanLP versions up to 2.1.0-beta.64 represents a critical security flaw within the Model Config Loading component, specifically located in the hanlp.load function found in the plugins/hanlp_common/hanlp_common/reflection.py file. This issue stems from an improper handling of user-supplied input during the deserialization process. When the application processes configuration data to load machine learning models or related components, it fails to adequately validate or sanitize the classpath argument provided by the caller. This lack of rigorous validation allows an attacker to inject malicious serialized objects that are then executed upon loading, leading to arbitrary code execution on the target system.
From a technical perspective, this vulnerability is classified under CWE-502, which denotes Deserialization of Untrusted Data. The core issue lies in the reflection mechanism used by HanLP to dynamically load classes based on configuration strings. By manipulating the classpath parameter, an attacker can force the application to instantiate arbitrary Java or Python objects that contain malicious payloads. Since this function is accessible remotely, the attack surface is significantly expanded, allowing adversaries to exploit the flaw over a network without requiring prior authentication in many deployment scenarios. The public disclosure of exploits for this vulnerability further increases the risk landscape, as automated tools and script-kiddies can now leverage known techniques to compromise systems running affected versions.
The operational impact of this vulnerability is severe, potentially resulting in full system compromise. An attacker who successfully exploits this flaw can execute arbitrary commands with the privileges of the application process. This could lead to data exfiltration, modification or destruction of critical model files and datasets, and the establishment of a persistent foothold within the network infrastructure. Given that HanLP is often used in production environments for natural language processing tasks, such as text classification, named entity recognition, and sentiment analysis, compromising these systems can disrupt business operations and lead to significant reputational damage due to data breaches or service outages.
Mitigation strategies should focus on immediate remediation through version updates and defensive coding practices. The primary recommendation is to upgrade HanLP to a patched version where the deserialization logic has been secured against untrusted input. In cases where upgrading is not immediately feasible, organizations should implement strict allow-listing for classpaths used in model configuration loading, ensuring that only known safe classes can be instantiated. Additionally, deploying network-level controls such as web application firewalls may help detect and block malicious payloads attempting to exploit this deserialization flaw. It is also advisable to isolate the HanLP service from other critical systems using containerization or microservices architecture limits to reduce the blast radius in the event of a successful exploitation attempt.
This vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it enables an attacker to execute commands on the target system through the abuse of legitimate software functionality. Furthermore, it relates to CWE-20 Improper Input Validation, highlighting the necessity for robust input sanitization in all components that handle dynamic class loading or configuration parsing. Security teams should prioritize patching this vulnerability given its remote exploitability and the availability of public proof-of-concept code, which significantly lowers the barrier to entry for potential attackers seeking to compromise systems relying on HanLP for natural language processing tasks.