NLTK versions earlier than 3.10.3 allow attackers to craft malicious pickle payloads that call dangerous functions during model or tokenizer artifact loading. The vulnerability stems from allowlisted pickle loaders that trust entire module namespaces rather than specific safe callables, enabling redirection to functions such as ReppTokenizer._execute or numpy.f2py.crackfortran.myeval via the REDUCE mechanism. Successful exploitation results in arbitrary code execution on the system where the library loads the payload, compromising confidentiality and integrity.

All installations of the NLTK Python library with a version prior to 3.10.3 are affected. This includes any environment that imports nltk and uses model or tokenizer artifact loading from potentially untrusted sources. The vulnerability applies across operating systems where the library is used, as the issue is within the Python package rather than platform‑specific code.

The CVSS score of 9.3 indicates high severity, while the EPSS score is not available, suggesting limited data on the exploit rate but the potential exists for exploitation wherever untrusted artifacts are loaded. The vulnerability is not listed in CISA KEV, so there is no current evidence of widespread exploitation. Attackers can achieve remote code execution by delivering a crafted pickle file, which the library deserializes during normal operation; this inference suggests the attack vector is via trusted user data or external input that triggers artifact loading. Organizations that expose NLTK functionality over a network or accept third‑party models face the highest risk.