HanLP CVE-2026-112081

Exploitation requires the victim to invoke hanlp.load() on an attacker-controlled model/config in which the classpath argument is manipulated, triggering unsafe deserialization/reflection in plugins/hanlp_common/hanlp_common/reflection.py. The key LIMITING factor is required user interaction (UI:P in the supplied vector): the victim must obtain and load a malicious or untrusted model - it is not triggered against a default, idle installation. No authentication is required (PR:N). Systems that only load trusted, first-party HanLP models are not realistically exposed; risk concentrates on pipelines that load third-party or externally sourced models.

This is a CWE-502 deserialization flaw in hankcs HanLP (≤2.1.0-beta.64) reached through the classpath argument during model config loading in hanlp.load. Signals are mixed and point to a moderate, not urgent, priority. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) describes low partial impact and, critically, requires user interaction (UI:P) - the victim must load an attacker-supplied model/config. There is NO EPSS score and NO SSVC decision in the input, so exploitation probability and automatability cannot be quantified. The flaw is NOT in CISA KEV, so there is no confirmed active exploitation; however a public POC (poc.zip) exists, so publicly available exploit code exists. CONFLICT TO NOTE: the VulDB CVSS caps impact at Low across C/I/A, yet CWE-502 deserialization driven by an attacker-controlled classpath typically yields arbitrary code execution (High impact) - this low scoring appears conservative and should be verified; my independent assessment rates impact higher. The decisive mitigating factor is the UI requirement plus an unresponsive-but-niche project: this is a real but conditional issue, not a mass-exploitable internet-facing RCE. Treat as medium priority - patch/pin when a fix lands and avoid loading untrusted models in the interim.

An attacker publishes or distributes a malicious HanLP model package whose config specifies an attacker-chosen classpath. A developer or application calls hanlp.load() on that untrusted model, and the deserialization/instantiation of the attacker-controlled class executes attacker code in the victim's Python process. A public proof-of-concept (poc.zip) has been released demonstrating the issue.