CVE-2023-39020
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Versions of stanford-parser v3.9.2 and below were found to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability can be exploited by passing an unchecked argument.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized code execution, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to update to the latest version of stanford-parser to mitigate this vulnerability and to implement validation of arguments passed to the component.
Original NVD description (English source)
stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.