EUVD-2026-64296
GHSA-5gh2-94qg-qppq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker delivers model via network with no auth (AV:N/PR:N); victim must load it (UI:R); arbitrary code execution yields full C/I/A; scope unchanged as execution stays within the NLTK process.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.
AnalysisAI
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim application calls TransitionParser.parse and supplies a model file sourced from an attacker-controlled or otherwise untrusted location. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) accurately reflects the threat: no authentication is required from the attacker's side, and the only gating factor is passive user interaction - the victim's system must load the malicious model file (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or delivers a crafted NLTK transition-parser model file - for example, via a public model-sharing platform, a poisoned research artifact, or a supply chain compromise of an internal model registry. When a victim application calls TransitionParser.parse with the malicious model file, allowlisted_pickle_load deserializes it using the vulnerable AllowlistUnpickler; the unpickler resolves a dotted-name gadget such as 'numpy.f2py.crackfortran.myeval' through attribute traversal on the allowlisted 'numpy' namespace, executing an arbitrary OS command in the victim process. … |
| Remediation | Upgrade to NLTK 3.10.3 or later, which contains the fix landed in commit c3e37113742a1ebeeb4f2ca58941f320f98805ea (https://github.com/nltk/nltk/commit/c3e37113742a1ebeeb4f2ca58941f320f98805ea). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running NLTK and determine which use the TransitionParser component with external or user-supplied model sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today