CVE-2026-112079 hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function loadword2vecasvocabtensor of the file hanlp/utils/torchutil.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The...