Tencent NeuralNLP-NeuralClassifier Deserialization Vulnerability Leading to Remote Code Execution

A remote code execution vulnerability has been identified in Tencent NeuralNLP-NeuralClassifier. This issue arises from insecure deserialization of user-supplied data in the _load_checkpoint function, allowing remote attackers to execute arbitrary code with root privileges. Exploitation requires user interaction, such as visiting a malicious page or opening a harmful file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the root user.

Remediation

Tencent has released a patch for this vulnerability. Details about the patch can be found in the commit history of the Tencent NeuralNLP-NeuralClassifier GitHub repository.