| Title | hankcs HanLP commit ddb1299bddff079e447af52ec12549c50636bfa8 (2.1.0-beta.64) Insecure Deserialization |
|---|
| Description | A vulnerability was found in HanLP commit ddb1299 (version 2.1.0-beta.64) and classified as high 8.8. Affected is the load_word2vec_as_vocab_tensor function of the word2vec embedding cache loader in hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to insecure deserialization (CWE-502). It is possible to launch the attack remotely when the victim loads an attacker-supplied embedding model directory; user interaction is required because the victim must point HanLP at the malicious model.
Technical Details
- Affected file/function: hanlp/utils/torch_util.py:221-245 load_word2vec_as_vocab_tensor(), sink at line 229; helper hanlp_common/io.py:16-18 load_pickle() (hanlp-common 0.0.23)
- Vulnerable parameter: same-named vectors.vocab cache file auto-derived next to the embedding text file (vectors.txt) and deserialized with unrestricted pickle.load when cache=True (default)
- Attack vector: Network (model directories are routinely distributed over the network); privileges required: None; user interaction: Required
- Trigger condition: a vectors.vocab containing a pickle __reduce__ gadget (e.g. os.system) exists beside the embedding file; HanLP restores the whole file as a bare pickle during model loading, before any vocab data is returned
Impact
- Confidentiality: High (arbitrary code execution with the privileges of the loading process)
- Integrity: High (arbitrary code execution)
- Availability: High (arbitrary code execution)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-30
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Restore vocab caches with a restricted unpickler allow-listing primitive types, or store vocabularies in a non-executable format (JSON), and bind cache files to the SHA-256 of the source vectors.txt so tampered caches are rejected and rebuilt; apply the same restriction to the sibling torch.load of vectors.pt and to the .pkl cache path of load_word2vec(). |
|---|
| Source | ⚠️ https://github.com/hankcs/HanLP/issues/1968 |
|---|
| User | r1ck9 (UID 97869) |
|---|
| Submission | 10/01/2026 13:32 (23 days ago) |
|---|
| Moderation | 10/18/2026 16:06 (17 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 421758 [hankcs HanLP up to 2.1.0-beta.64 torch_util.py load_word2vec_as_vocab_tensor vectors.vocab deserialization] |
|---|
| Points | 20 |
|---|