Soumettre #1009644: hankcs HanLP commit ddb1299bddff079e447af52ec12549c50636bfa8 (2.1.0-beta.64) Insecure Deserialization

A vulnerability was found in HanLP commit ddb1299 (version 2.1.0-beta.64) and classified as high 8.8. Affected is the load_word2vec_as_vocab_tensor function of the word2vec embedding cache loader in hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to insecure deserialization (CWE-502). It is possible to launch the attack remotely when the victim loads an attacker-supplied embedding model directory; user interaction is required because the victim must point HanLP at the malicious model.

Technical Details
- Affected file/function: hanlp/utils/torch_util.py:221-245 load_word2vec_as_vocab_tensor(), sink at line 229; helper hanlp_common/io.py:16-18 load_pickle() (hanlp-common 0.0.23)
- Vulnerable parameter: same-named vectors.vocab cache file auto-derived next to the embedding text file (vectors.txt) and deserialized with unrestricted pickle.load when cache=True (default)
- Attack vector: Network (model directories are routinely distributed over the network); privileges required: None; user interaction: Required
- Trigger condition: a vectors.vocab containing a pickle __reduce__ gadget (e.g. os.system) exists beside the embedding file; HanLP restores the whole file as a bare pickle during model loading, before any vocab data is returned

Impact
- Confidentiality: High (arbitrary code execution with the privileges of the loading process)
- Integrity: High (arbitrary code execution)
- Availability: High (arbitrary code execution)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-30
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Restore vocab caches with a restricted unpickler allow-listing primitive types, or store vocabularies in a non-executable format (JSON), and bind cache files to the SHA-256 of the source vectors.txt so tampered caches are rejected and rebuilt; apply the same restriction to the sibling torch.load of vectors.pt and to the .pkl cache path of load_word2vec().

• La source: ⚠️ https://github.com/hankcs/HanLP/issues/1968
• Utilisateur: r1ck9 (UID 97869)
• Soumission: 01/10/2026 13:32 (il y a 18 jours)
• Modérer: 18/10/2026 16:06 (17 days later)
• Statut: Accepté
• Entrée VulDB: 421758 [hankcs HanLP jusqu’à 2.1.0-beta.64 torch_util.py load_word2vec_as_vocab_tensor vectors.vocab élévation de privilèges]
• Points: 20