| Titre | hankcs HanLP 2.1.0-beta.64 (git commit ddb1299bddff079e447af52ec12549c50636bfa8) Insecure Deserialization |
|---|
| Description | A vulnerability was found in HanLP 2.1.0-beta.64 (git commit ddb1299bddff079e447af52ec12549c50636bfa8) and classified as medium 6.3. Affected is the model config loading component (hanlp.load / load_from_meta_file / Configurable.from_config / str_to_type). The manipulation of the argument classpath in a model package JSON leads to insecure deserialization: the string is resolved with importlib.import_module() and the resulting class is instantiated with attacker-controlled constructor arguments, without an allowlist or origin check. It is possible to launch the attack remotely. User interaction is required because the victim must load a model package obtained from an untrusted source.
Technical Details
- Affected file/function: plugins/hanlp_common/hanlp_common/reflection.py str_to_type(); plugins/hanlp_common/hanlp_common/configurable.py Configurable.from_config(); hanlp/utils/component_util.py load_from_meta_file()/load_from_meta(); hanlp/components/pipeline.py Pipe.from_config()/Pipeline.from_config(); hanlp/layers/embeddings/fast_text.py FastTextEmbedding/FastTextTransform; hanlp/utils/io_util.py get_resource()
- Vulnerable parameter: classpath and component filepath fields of the model JSON
- Attack vector: Network (crafted model package distributed via mirror/download/chat)
- Privileges required: None
- Trigger condition: victim runs hanlp.load() on the crafted package; choosing the installed class hanlp.layers.embeddings.fast_text.FastTextEmbedding turns filepath into an attacker-controlled URL that the victim downloads (GET) and caches under ~/.hanlp/thirdparty/<host>[:<port>]/ before fasttext.load_model() parses the bytes. The loading protocol bounds the flaw: the top-level class must expose load() and components must be constructible from config, so targets such as subprocess.Popen are rejected and the package's own Python files are never imported. Arbitrary code execution was not demonstrated.
Impact
- Confidentiality: Low (victim contacts attacker host; presence, IP, egress timing and library versions leak; attacker bytes parsed in-process)
- Integrity: Low (the model/embedding used by the application is fully attacker-chosen; attacker bytes cached inside the victim's HanLP home directory)
- Availability: Low (attacker-controlled binary input reaches the fastText parser; malformed input fails the load)
CVSS v3.1
Score: 6.3 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Timeline
- Discovered: 2026-10-01
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Resolve classpath only against the classes shipped with the model package (signed manifest) or a static allowlist of HanLP component classes; restrict component resource paths to package-local files or the model's declared origin; add and verify checksums before instantiation; document that loading untrusted model packages is unsafe without an explicit opt-in. |
|---|
| La source | ⚠️ https://github.com/hankcs/HanLP/issues/1969 |
|---|
| Utilisateur | r1ck9 (UID 97869) |
|---|
| Soumission | 01/10/2026 14:18 (il y a 18 jours) |
|---|
| Modérer | 18/10/2026 16:12 (17 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 421760 [hankcs HanLP jusqu’à 2.1.0-beta.64 Model Config Loading reflection.py hanlp.load classpath élévation de privilèges] |
|---|
| Points | 20 |
|---|