| 제목 | hankcs HanLP commit ddb1299bddff079e447af52ec12549c50636bfa8 (2.1.0-beta.64) Insecure Deserialization |
|---|
| 설명 | A vulnerability was found in HanLP commit ddb1299 (version 2.1.0-beta.64) and classified as high 8.8. Affected is the load_word2vec_as_vocab_tensor function of the word2vec embedding cache loader in hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to insecure deserialization (CWE-502). It is possible to launch the attack remotely when the victim loads an attacker-supplied embedding model directory; user interaction is required because the victim must point HanLP at the malicious model.
Technical Details
- Affected file/function: hanlp/utils/torch_util.py:221-245 load_word2vec_as_vocab_tensor(), sink at line 229; helper hanlp_common/io.py:16-18 load_pickle() (hanlp-common 0.0.23)
- Vulnerable parameter: same-named vectors.vocab cache file auto-derived next to the embedding text file (vectors.txt) and deserialized with unrestricted pickle.load when cache=True (default)
- Attack vector: Network (model directories are routinely distributed over the network); privileges required: None; user interaction: Required
- Trigger condition: a vectors.vocab containing a pickle __reduce__ gadget (e.g. os.system) exists beside the embedding file; HanLP restores the whole file as a bare pickle during model loading, before any vocab data is returned
Impact
- Confidentiality: High (arbitrary code execution with the privileges of the loading process)
- Integrity: High (arbitrary code execution)
- Availability: High (arbitrary code execution)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-30
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Restore vocab caches with a restricted unpickler allow-listing primitive types, or store vocabularies in a non-executable format (JSON), and bind cache files to the SHA-256 of the source vectors.txt so tampered caches are rejected and rebuilt; apply the same restriction to the sibling torch.load of vectors.pt and to the .pkl cache path of load_word2vec(). |
|---|
| 원천 | ⚠️ https://github.com/hankcs/HanLP/issues/1968 |
|---|
| 사용자 | r1ck9 (UID 97869) |
|---|
| 제출 | 2026. 10. 01. PM 01:32 (24 날 ago) |
|---|
| 모더레이션 | 2026. 10. 18. PM 04:06 (17 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 421758 [hankcs HanLP 까지 2.1.0-beta.64 torch_util.py load_word2vec_as_vocab_tensor vectors.vocab 권한 상승] |
|---|
| 포인트들 | 20 |
|---|