CVE-2026-78683NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization

Description

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Security Advisory (GHSA-rhp5-r9x4-f5g2) vendor-advisoryExploitVendor Advisory
• VulnCheck Advisory: NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization third-party-advisoryThird Party Advisory