CVE-2026-112081

A deserialization vulnerability exists in hankcs HanLP versions up to 2.1.0-beta.64 . The flaw is located in the Model Config Loading component, specifically within the hanlp.load function in the file plugins/hanlp_common/hanlp_common/reflection.py. An attacker can trigger the vulnerability by ma...

CVE-2026-112079

The hankcs HanLP library (up to version 2.1.0-beta.64 ) contains a remote deserialization vulnerability in the load_word2vec_as_vocab_tensor function located in hanlp/utils/torch_util.py . The flaw exists because the vectors.vocab argument can be manipulated to trigger deserialization of untruste...