Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112079hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in HanLP from hankcs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
hankcs	HanLP	2.1.0-beta.02.1.0-beta.12.1.0-beta.22.1.0-beta.32.1.0-beta.42.1.0-beta.52.1.0-beta.62.1.0-beta.7

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-421758 | hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization vdb-entry, technical-description
VDB-421758 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-112079 | CVE Analysis and Report third-party-advisory
Submit #1009644 | hankcs HanLP commit ddb1299bddff079e447af52ec12549c50636bfa8 (2.1.0-beta.64) Insecure Deserialization third-party-advisory
https://github.com/hankcs/HanLP/issues/1968 issue-tracking
https://github.com/user-attachments/files/32910161/hanlp-ddb1299-vocab-pickle-poc.zip exploit
https://github.com/hankcs/HanLP/ product