Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112081hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in HanLP from hankcs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
hankcs	HanLP	2.1.0-beta.02.1.0-beta.12.1.0-beta.22.1.0-beta.32.1.0-beta.42.1.0-beta.52.1.0-beta.62.1.0-beta.7

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-421760 | hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization vdb-entry, technical-description
VDB-421760 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-112081 | CVE Analysis and Report third-party-advisory
Submit #1009708 | hankcs HanLP 2.1.0-beta.64 (git commit ddb1299bddff079e447af52ec12549c50636bfa8) Insecure Deserialization third-party-advisory
https://github.com/hankcs/HanLP/issues/1969 issue-tracking
https://github.com/user-attachments/files/32911743/poc.zip exploit
https://github.com/hankcs/HanLP/ product