NLTK releases 3.10.0 through 3.10.2 contain a flaw in AllowlistUnpickler that verifies only the pickle module string but not the global name. This allows an attacker to craft a pickle that traverses attributes to resolve a callable outside the allowlisted namespace. When the vulnerable TransitionParser.parse function loads the malicious pickle via allowlisted_pickle_load, the code contained in the model is executed, giving the attacker arbitrary command execution on the host. The weakness is a classic insecure deserialization issue, classified as CWE‑502.

Any installation of the NLTK library running versions 3.10.0, 3.10.1 or 3.10.2 is vulnerable. Systems that use TransitionParser.parse to load transition‑parser models from untrusted sources or that provide third‑party pickle files to the application are affected.

The CVSS score of 8.7 indicates high severity, while the EPSS score of 1% points to a low but nonzero likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote: a malicious actor must be able to supply or modify a pickle file that the application will load via TransitionParser.parse. If that requirement can be met, the allowlist bypass can be exploited to execute arbitrary code without additional privileges.