GHSA-353m-jh2m-72v4

Code injection in stanford-parser

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-39020

Packages

Ecosystem	Package	Affected	Fixed in
Maven	edu.stanford.nlp:stanford-parser	< 4.5.5	4.5.5

Details

As written in the advisory (Markdown source, shown as plain text).

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-39020 advisory
https://github.com/stanfordnlp/CoreNLP/commit/897231bed0efb24574c80c875c0b5f2225c145bc web
https://github.com/LetianYuan/My-CVE-Public-References/tree/main/edu_stanford_nlp_stanford-parser web
https://github.com/stanfordnlp/CoreNLP package