CVE-2026-78683

NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization

Published Aug 25, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Description

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.

Analysis

Technical impact

NLTK versions older than 3.10.0 contain an unsafe pickle deserialization flaw in the TransitionParser.parse method. The method calls pickle_load with restricted=False and routes the data through WarningUnpickler, which does not override find_class, thereby allowing arbitrary class resolution. An attacker can craft a malicious model file that, when loaded, triggers arbitrary Python code execution with the privileges of the user running the application, compromising confidentiality, integrity, and availability.

Affected Systems

The vulnerability affects the NLTK library for all users of versions up to and including 3.9.4, regardless of operating system or deployment environment. The fix is included in NLTK 3.10.0 and later.

Risk and Exploitability

The CVSS score of 9.4 indicates a critical severity, while EPSS data is not available, making the current exploitation probability unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or application‑level, where an attacker supplies a malicious model file that the NLTK parser processes, resulting in arbitrary code execution with the user’s privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nltk

unaffected

Version	Status	Constraints
`0`	affected	< 3.10.0
`3.10.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Nltk

Version	Status	Scheme	Platform
`[0,3.10.0)`	affected	semver	—
`3.10.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the NLTK package to version 3.10.0 or later to apply the official fix for unsafe pickling.
If upgrading is not possible, patch code paths that use TransitionParser.parse to employ NLTK’s RestrictedUnpickler or a similarly safe deserialization mechanism, ensuring only trusted pickle data is loaded.
Restrict the source of model files so that only trusted files are loaded, and validate input so that untrusted data cannot trigger deserialization by the parser.

Generated by OpenCVE AI on August 25, 2026 at 04:06 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rhp5-r9x4-f5g2	NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.510% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2
https://www.vulncheck.com/advisories/nltk-before-remote-code-execution-via-unsafe-pickle-deserialization

History

Aug 25, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 2:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.
Title		NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
First Time appeared		Nltk Nltk nltk
Weaknesses		CWE-502
CPEs		cpe:2.3:a:nltk:nltk::::::::
Vendors & Products		Nltk Nltk nltk
References		https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2 https://www.vulncheck.com/advisories/nltk-before-remote-code-execution-via-unsafe-pickle-deserialization
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`