NLTK EUVD-2026-65229

Requires that the victim application load an attacker-crafted TransitionParser model file through the TransitionParser.parse() code path - the CVSS UI:P element reflects that exploitation is not fully autonomous and hinges on a model-loading action. The concrete prerequisite is deserialization of an untrusted model via the default restricted=False path (WarningUnpickler); environments that load only first-party, integrity-checked models are not realistically exploitable. Limiting factors: the attacker must get their malicious model into a location the target trusts and loads, and no service is remotely exploitable without this model-ingestion step. No attacker authentication is needed to craft the model (PR:N), but delivery into the victim's model-loading workflow is the gating condition.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, base 9.4) rates this critical, and the impact is genuine full code execution (VC/VI/VA:H). The vector's key limiter is UI:P - exploitation is not autonomous; a user or application must load an attacker-controlled model file. This is a trusted-deserialization bug rather than a remotely-sprayable service vulnerability, so real-world risk depends on whether an environment loads NLTK models from untrusted or attacker-influenceable sources (downloaded models, shared registries, user uploads). No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, which argues against widespread opportunistic exploitation; risk is concentrated in ML/data pipelines that ingest third-party model artifacts. Note the input 4.0 vector sets subsequent-system impact SC/SI/SA:H, but same-user pickle RCE has no inherent cross-system scope change - that subsequent-system rating likely overstates scope and should be verified with the vendor advisory.

An attacker publishes or substitutes a malicious NLTK transition-parser model file - for example in a public model repository, a shared internal artifact store, or as a user-uploaded 'trained model'. A data pipeline or application calls TransitionParser.parse() and loads the file, causing the embedded pickle gadget chain to execute arbitrary Python code as the pipeline's service account. No public POC is identified, but pickle deserialization exploits are well understood and straightforward to construct.