CVE-2026-54499: PyTorch pickle fallback bypass

Q: Is CVE-2026-54499 actively exploited?

No confirmed active exploitation of CVE-2026-54499 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-54499?

1. PATCH: Upgrade stanza to 1.12.2 immediately — this is the only complete fix. 2. VERIFY: After upgrade, confirm all six affected loader files no longer contain the unsafe fallback pattern (grep -r 'weights_only=False' in the stanza package directory). 3. AUDIT MODEL SOURCES: Enumerate all .pt files loaded by stanza.Pipeline() in your environment; verify SHA-256 checksums against trusted manifests. 4. LOCK MODEL CACHES: If shared model storage is used (NFS, S3), apply write-access controls so only trusted pipelines can publish pretrain files. 5. DETECT: Add filesystem monitoring (auditd/Falco) for unexpected writes from processes that import stanza — specifically from stanza worker processes writing to /tmp or env config paths. 6. CI/CD HARDENING: Pin stanza version with a hash in requirements.txt and validate model file checksums in pipeline steps before loading. 7. SHORT-TERM WORKAROUND (if patching is delayed): Set PYTHONPATH to a patched local copy of pretrain.py that removes the except UnpicklingError fallback block.

Q: What systems are affected by CVE-2026-54499?

This vulnerability affects the following AI/ML architecture patterns: NLP inference pipelines, Training pipelines, CI/CD model build systems, Shared model cache environments (NFS, S3), Research Jupyter notebook servers.

Q: What is the CVSS score for CVE-2026-54499?

CVE-2026-54499 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.34%.

CISO Take

Stanza NLP ≤1.12.1 contains a logic flaw in six model loaders: when PyTorch safe deserialization (weights_only=True) raises an UnpicklingError — a condition fully controllable by an attacker — Stanza silently retries the same file with the unrestricted pickle deserializer, executing arbitrary __reduce__ methods. With 2,954 downstream dependents spanning research environments, CI/CD pipelines, and production NLP services, any team loading Stanza pretrain files from a shared or external source (HuggingFace, S3 model caches, artifact stores) is exposed to full remote code execution with process-level privileges. A functional PoC is included in the advisory and the attack requires only placing one malformed .pt file at a path Stanza will load — no authentication or network access to the victim system is needed beyond the supply chain vector. Upgrade immediately to stanza==1.12.2, audit model source provenance, and enforce cryptographic checksums on all pretrain files before loading.

Sources: NVD GitHub Advisory OpenSSF ATLAS

What is the risk?

High severity in practice despite CVSS 7.5. The critical aggravating factor is the attacker-controllable trigger: any .pt file embedding a single unsupported pickle global will reliably defeat the safety mechanism. The blast radius is amplified by the six affected loaders (pretrain, coreference, classifier, constituency, lemma_classifier) and the 2,954 downstream packages that import stanza. Exploitation is straightforward — the advisory includes a working PoC. The primary mitigant is the supply chain delivery prerequisite (attacker must place a file at a loadable path), but shared NFS mounts, S3 model caches, and HuggingFace auto-downloads make this realistic in most ML team environments. No active exploitation is confirmed, but the PoC lowers the bar to opportunistic actors targeting AI/ML infrastructure.

How does the attack unfold?

Supply Chain Poisoning

Attacker compromises a HuggingFace repository or shared model cache and publishes a structurally valid Stanza .pt pretrain file embedding a malicious pickle __reduce__ payload.

AML.T0058

Victim Model Load

Victim calls stanza.Pipeline() or load_pretrain(), which invokes Pretrain.load(); torch.load with weights_only=True raises UnpicklingError on the embedded unsupported pickle global.

AML.T0011.000

Safe-Load Bypass

Stanza's except UnpicklingError block silently retries the same attacker-controlled file with weights_only=False, invoking Python's full unrestricted pickle deserializer.

AML.T0010.003

Arbitrary Code Execution

The pickle __reduce__ method fires with full process privileges, enabling credential theft (cloud IAM keys, HuggingFace tokens), reverse shell establishment, or persistent backdoor installation.

AML.T0018.002

Supply Chain Poisoning

Attacker compromises a HuggingFace repository or shared model cache and publishes a structurally valid Stanza .pt pretrain file embedding a malicious pickle __reduce__ payload.

AML.T0058

Victim Model Load

Victim calls stanza.Pipeline() or load_pretrain(), which invokes Pretrain.load(); torch.load with weights_only=True raises UnpicklingError on the embedded unsupported pickle global.

AML.T0011.000

Safe-Load Bypass

Stanza's except UnpicklingError block silently retries the same attacker-controlled file with weights_only=False, invoking Python's full unrestricted pickle deserializer.

AML.T0010.003

Arbitrary Code Execution

The pickle __reduce__ method fires with full process privileges, enabling credential theft (cloud IAM keys, HuggingFace tokens), reverse shell establishment, or persistent backdoor installation.

AML.T0018.002

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PyTorch	pip	<= 1.12.1	`1.12.2`
102.1K OpenSSF 6.4 24.2K dependents Pushed 6d ago 13% patched ~256d to patch Full package profile →
PyTorch	pip	—	No patch
102.1K OpenSSF 6.4 24.2K dependents Pushed 6d ago 13% patched ~256d to patch Full package profile →

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Unchanged

C High

I High

A High

What should I do?

7 steps

PATCH

Upgrade stanza to 1.12.2 immediately — this is the only complete fix.
VERIFY

After upgrade, confirm all six affected loader files no longer contain the unsafe fallback pattern (grep -r 'weights_only=False' in the stanza package directory).
AUDIT MODEL SOURCES

Enumerate all .pt files loaded by stanza.Pipeline() in your environment; verify SHA-256 checksums against trusted manifests.
LOCK MODEL CACHES

If shared model storage is used (NFS, S3), apply write-access controls so only trusted pipelines can publish pretrain files.
DETECT

Add filesystem monitoring (auditd/Falco) for unexpected writes from processes that import stanza — specifically from stanza worker processes writing to /tmp or env config paths.
CI/CD HARDENING: Pin stanza version with a hash in requirements.txt and validate model file checksums in pipeline steps before loading.
SHORT-TERM WORKAROUND (if patching is delayed): Set PYTHONPATH to a patched local copy of pretrain.py that removes the except UnpicklingError fallback block.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution Model Framework AML.T0010.001 - AI Software AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0018.002 - Embed Malware AML.T0058 - Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system for high-risk AI

ISO 42001

A.6.1.2 - Supply chain security for AI systems

NIST AI RMF

GOVERN 6.2 - AI supply chain risk management

OWASP LLM Top 10

LLM05:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-54499?

Stanza NLP ≤1.12.1 contains a logic flaw in six model loaders: when PyTorch safe deserialization (weights_only=True) raises an UnpicklingError — a condition fully controllable by an attacker — Stanza silently retries the same file with the unrestricted pickle deserializer, executing arbitrary __reduce__ methods. With 2,954 downstream dependents spanning research environments, CI/CD pipelines, and production NLP services, any team loading Stanza pretrain files from a shared or external source (HuggingFace, S3 model caches, artifact stores) is exposed to full remote code execution with process-level privileges. A functional PoC is included in the advisory and the attack requires only placing one malformed .pt file at a path Stanza will load — no authentication or network access to the victim system is needed beyond the supply chain vector. Upgrade immediately to stanza==1.12.2, audit model source provenance, and enforce cryptographic checksums on all pretrain files before loading.

Is CVE-2026-54499 actively exploited?

No confirmed active exploitation of CVE-2026-54499 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54499?

1. PATCH: Upgrade stanza to 1.12.2 immediately — this is the only complete fix. 2. VERIFY: After upgrade, confirm all six affected loader files no longer contain the unsafe fallback pattern (grep -r 'weights_only=False' in the stanza package directory). 3. AUDIT MODEL SOURCES: Enumerate all .pt files loaded by stanza.Pipeline() in your environment; verify SHA-256 checksums against trusted manifests. 4. LOCK MODEL CACHES: If shared model storage is used (NFS, S3), apply write-access controls so only trusted pipelines can publish pretrain files. 5. DETECT: Add filesystem monitoring (auditd/Falco) for unexpected writes from processes that import stanza — specifically from stanza worker processes writing to /tmp or env config paths. 6. CI/CD HARDENING: Pin stanza version with a hash in requirements.txt and validate model file checksums in pipeline steps before loading. 7. SHORT-TERM WORKAROUND (if patching is delayed): Set PYTHONPATH to a patched local copy of pretrain.py that removes the except UnpicklingError fallback block.

What systems are affected by CVE-2026-54499?

This vulnerability affects the following AI/ML architecture patterns: NLP inference pipelines, Training pipelines, CI/CD model build systems, Shared model cache environments (NFS, S3), Research Jupyter notebook servers.

What is the CVSS score for CVE-2026-54499?

CVE-2026-54499 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

NLP inference pipelinesTraining pipelinesCI/CD model build systemsShared model cache environments (NFS, S3)Research Jupyter notebook servers

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0018.002 Embed Malware

AML.T0058 Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or model file to execute arbitrary pickle code when a Stanza NLP pipeline loads it. This issue is fixed in version 1.12.2.

Exploitation Scenario

An attacker targeting an AI/NLP team identifies that their CI/CD pipeline auto-downloads Stanza pretrain files from a HuggingFace model repository. The attacker compromises a contributor account on that repository or submits a malicious pull request that passes automated review. They craft a structurally valid Stanza pretrain state dict containing a HarmlessPayload object (or a destructive equivalent: a reverse shell spawner via subprocess.Popen) serialized via pickle's __reduce__ mechanism. The file is indistinguishable from a legitimate pretrain file at the metadata level. When the CI pipeline executes stanza.Pipeline('en') on the next build, Stanza's pretrain.py attempts torch.load with weights_only=True; the embedded unsupported global triggers UnpicklingError; the except block immediately reloads the same file with weights_only=False; the __reduce__ method fires, spawning a reverse shell or dropping an SSH key. The attacker now has persistent access to the build environment with credentials to cloud artifact stores, container registries, and downstream production systems.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data Primary CWE-676 Use of Potentially Dangerous Function Primary CWE-676 Use of Potentially Dangerous Function Primary CWE-502 Deserialization of Untrusted Data CWE-676 Use of Potentially Dangerous Function

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.