NLTK CVE-2026-71513

Exploitation requires that the victim application calls TransitionParser.parse and supplies a model file sourced from an attacker-controlled or otherwise untrusted location. The CVSS 4.0 UI:P metric confirms passive user interaction is required - the victim process must initiate the model load. No authentication or network privileges are required on the attacker's side (PR:N, AV:N), as the malicious model can be delivered through any file distribution channel (model hub download, email, shared filesystem, CI artifact). Exploitation is bounded to NLTK versions 3.10.0-3.10.2 only; versions prior to 3.10.0 and 3.10.3 and later are not affected by this specific dotted-name bypass. The vulnerability is confined to the TransitionParser.parse code path through allowlisted_pickle_load - other NLTK deserialization paths are not confirmed vulnerable by the available data. Exploitation is not possible if the application loads only internally-generated or cryptographically verified model files.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) accurately reflects the threat: no authentication is required from the attacker's side, and the only gating factor is passive user interaction - the victim's system must load the malicious model file (UI:P). There is no CISA KEV listing and no public exploit code has been identified, making mass opportunistic exploitation less likely at this time. However, the pickle gadget pattern underlying this bypass is well-understood in the security research community, significantly lowering the bar for exploit development. EPSS data was not included in the provided intelligence and cannot be cited. The vulnerability is narrowly scoped to TransitionParser.parse model loading from untrusted sources; organizations that programmatically download and load pre-trained NLTK transition-parser models from external model hubs or shared research artifacts face the highest realistic risk. The CVSS 4.0 'S:X' supplemental metrics are unset, leaving system-of-systems impact unassessed. No conflicting signals are present - vector, description, and fix diff are internally consistent.

An attacker publishes or delivers a crafted NLTK transition-parser model file - for example, via a public model-sharing platform, a poisoned research artifact, or a supply chain compromise of an internal model registry. When a victim application calls TransitionParser.parse with the malicious model file, allowlisted_pickle_load deserializes it using the vulnerable AllowlistUnpickler; the unpickler resolves a dotted-name gadget such as 'numpy.f2py.crackfortran.myeval' through attribute traversal on the allowlisted 'numpy' namespace, executing an arbitrary OS command in the victim process. No public exploit code has been identified, but the pickle gadget construction technique for this class of bypass is extensively documented in security research literature.