CVE-2026-112081

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...

CVE-2026-112079

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The...

CVE-2026-112081

A deserialization vulnerability exists in hankcs HanLP versions up to 2.1.0-beta.64 . The flaw is located in the Model Config Loading component, specifically within the hanlp.load function in the file plugins/hanlp_common/hanlp_common/reflection.py. An attacker can trigger the vulnerability by ma...

CVE-2026-112081 hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...

CVE-2026-112081 hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...

CVE-2026-112079 hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The...

CVE-2026-112079

The hankcs HanLP library (up to version 2.1.0-beta.64 ) contains a remote deserialization vulnerability in the load_word2vec_as_vocab_tensor function located in hanlp/utils/torch_util.py . The flaw exists because the vectors.vocab argument can be manipulated to trigger deserialization of untruste...

CVE-2026-112079

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The...

CVE-2026-112079 hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The...

CVE-2026-112079 hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The...

CVE-2026-112081: Deserialization of Untrusted Data

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...