CVE-2026-59974

Stanza, Stanford NLP's Python library for tokenization, NER, and parsing, contains a zip path traversal flaw in stanza.resources.common.unzip (stanza/resources/common.py), which passes downloaded model and resource archives directly to zipfile.ZipFile.extractall without validating member paths. The vulnerable extraction path is reachable through the commonly used stanza.download and stanza.install_corenlp functions, so a malicious archive containing parent-directory traversal entries can write files outside the intended model directory. An attacker who can supply or tamper with the archive (for example via a compromised mirror, proxy, or man-in-the-middle download) gains arbitrary file writes with the privileges of the Stanza process, potentially achieving code execution by overwriting shell configuration, SSH authorized_keys, Python packages, or executable scripts. Anyone running Stanza prior to version 1.14.0 is affected. No public proof-of-concept or confirmed exploitation is known, and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade Stanza to version 1.14.0 or later, which validates archive member paths before extraction. Until upgraded, avoid running stanza.download or stanza.install_corenlp from untrusted networks, proxies, or unofficial model mirrors, and review model directories plus shell startup files, ~/.ssh/authorized_keys, site-packages, and scripts for unexpected modifications on hosts where untrusted downloads occurred.