HanLP EUVD-2026-104067

Exploitation requires a victim to load an attacker-supplied word2vec vectors.vocab file through HanLP's load_word2vec_as_vocab_tensor function, which deserializes it with Python pickle. The key prerequisite and primary limiting factor is this user interaction (UI:P): the attack is not against a running network service but depends on a user being tricked into opening or loading a malicious/untrusted model file. No authentication is required of the attacker (PR:N), and no special non-default product configuration is needed - the vulnerable loading path exists in HanLP up to 2.1.0-beta.64 - but the mandatory file-loading step and reliance on social engineering or a compromised model-distribution channel meaningfully constrain mass exploitation.

This is a CWE-502 untrusted-deserialization (Python pickle) flaw in HanLP's load_word2vec_as_vocab_tensor function, where a crafted vectors.vocab argument/file is unpickled. The signals are mixed. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) with only Low impacts yields a modest 5.3, but that Low/Low/Low impact rating understates typical pickle deserialization, which generally grants arbitrary code execution in the loading process - my independent assessment rates impact as High across C/I/A. Exploitation is NOT unattended: UI:P (passive user interaction) means a victim must be induced to load an attacker-supplied word2vec/vocab file, so this is a trust-boundary/supply-style issue rather than a direct remote-service compromise. A public POC exists (a pickle POC zip), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread automated exploitation - risk is opportunistic/targeted (tricking a user into loading a malicious model). Note the vendor was notified via issue #1968 but has not responded, so no fix is confirmed. Net: a genuine code-execution risk for anyone who loads untrusted HanLP vocab/model files, but lower urgency than the 'remote unauthenticated' phrasing suggests because user interaction is mandatory and there is no mass-exploitation signal.

An attacker publishes or shares a malicious HanLP word2vec vocabulary/model file (as in the public pickle POC) that embeds a serialized object with an attacker-controlled reduce payload. When a victim loads that file via load_word2vec_as_vocab_tensor, the pickle is deserialized and the embedded code executes in the victim's Python process. A public POC archive (hanlp-ddb1299-vocab-pickle-poc.zip) demonstrates the technique.