NLTK versions older than 3.10.0 contain an unsafe pickle deserialization flaw in the TransitionParser.parse method. The method calls pickle_load with restricted=False and routes the data through WarningUnpickler, which does not override find_class, thereby allowing arbitrary class resolution. An attacker can craft a malicious model file that, when loaded, triggers arbitrary Python code execution with the privileges of the user running the application, compromising confidentiality, integrity, and availability.

The vulnerability affects the NLTK library for all users of versions up to and including 3.9.4, regardless of operating system or deployment environment. The fix is included in NLTK 3.10.0 and later.

The CVSS score of 9.4 indicates a critical severity, while EPSS data is not available, making the current exploitation probability unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or application‑level, where an attacker supplies a malicious model file that the NLTK parser processes, resulting in arbitrary code execution with the user’s privileges.