CVE-2023-39020: Stanford Parser

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.

Affected products

• Stanford Stanford Parser: before 4.5.5 (fixed in 4.5.5)

Published 2023-07-28. Last modified 2026-06-17.