EUVD-2026-65440
GHSA-vp9c-2pjm-8925
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious pickle artifact with REDUCE gadget
-
DeliveryDistribute via model hub or download path
-
ExploitVictim loads artifact with allowlisted loader
-
ExecutionInvoke in-namespace callable during unpickling
-
ImpactExecute arbitrary commands in process context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target application to deserialize an attacker-supplied or tampered NLTK pickle artifact (model/tokenizer) using NLTK's allowlisted 'safe' pickle loader on a version before 3.10.3; the payload must invoke an in-namespace callable reachable through an allowlisted module (e.g., ReppTokenizer._execute or numpy.f2py.crackfortran.myeval) via the pickle REDUCE opcode. Limiting factors: exploitation is gated on the victim loading untrusted artifact data - if all loaded models come from trusted, integrity-verified sources the path is not reached - and availability of specific gadgets depends on which modules (e.g., numpy) are importable in the victim environment. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.3 (Critical) and reflects full compromise of confidentiality, integrity, and availability once a malicious artifact reaches a vulnerable loader. The practical trigger, however, is deserialization of an attacker-supplied pickle artifact: exploitation depends on an application loading an untrusted or tampered model/tokenizer via NLTK's allowlisted loader, which is a real limiting factor the raw network-vector score understates. There is no CISA KEV listing and no EPSS score was provided, and the advisory does not claim a public PoC, so this is currently a high-severity, high-plausibility issue rather than confirmed active exploitation. The danger is elevated by NLTK's ubiquity in ML/data pipelines and by the false sense of safety the allowlist provides - teams may deliberately load untrusted artifacts because they believe the 'safe' loader protects them. No conflicting signals in the core data; the main gap is the absence of EPSS/KEV to gauge real-world exploitation velocity. |
| Exploit ScenarioDerived | An attacker publishes a tampered tokenizer or tagger artifact (for example on a model-sharing hub or via a compromised download URL) that embeds a pickle REDUCE payload invoking an allowlisted in-namespace function such as numpy.f2py.crackfortran.myeval. A victim application on NLTK < 3.10.3 loads the artifact with the 'safe' allowlisted loader, and the crafted payload executes arbitrary OS commands in the process context. No public PoC is identified, but the gadget functions are named in the advisory, lowering the bar to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's pickle allowlist and run commands when a crafted model or tokenizer artifact is loaded. The allowlist trusts whole module namespaces rather than specific safe callables, so dangerous in-namespace functions can be invoked via pickle's REDUCE opcode. Reported by VulnCheck; no public exploit identified at time of analysis, though the root cause and gadget functions are documented in the advisory.
RemediationAI
Upgrade to NLTK 3.10.3 or later, which narrows the pickle allowlist to specific safe callables (Vendor-released patch: 3.10.3), per GHSA-x99w-6fgc-pmfw. Until upgrading, do not load NLTK model or tokenizer artifacts from untrusted or unverified sources, and pin/verify artifact integrity (checksums or signatures) for anything fetched from third-party hubs, mirrors, or user uploads; the trade-off is added operational overhead and breakage if pipelines rely on dynamically downloaded models. Where feasible, run artifact-loading code in an isolated, least-privilege sandbox (separate container/user, no outbound network, read-only filesystem) so a successful REDUCE gadget cannot reach production credentials or run commands with broad privileges. Review any application that exposes NLTK model loading to externally influenced paths and restrict it to a vetted, locally-controlled artifact directory. Advisory URLs: https://github.com/nltk/nltk/security/advisories/GHSA-x99w-6fgc-pmfw and https://www.vulncheck.com/advisories/nltk-before-3.10.3-remote-code-execution-via-unsafe-pickle-deserialization.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NLTK is one of the most widely used Python libraries for natural language processing, distributing and loading serialized model/tokenizer artifacts (taggers, tokenizers, etc.) that are stored as Python pickles. To mitigate the well-known danger of unpickling untrusted data (CWE-502, Deserialization of Untrusted Data), NLTK introduced 'safe' loaders backed by an allowlist. The flaw is that the allowlist authorizes entire module namespaces instead of an explicit set of safe callables, so any callable reachable in a trusted module - such as nltk's ReppTokenizer._execute or numpy.f2py.crackfortran.myeval - becomes usable as a pickle REDUCE gadget. Because pickle's REDUCE opcode calls an arbitrary callable with attacker-controlled arguments, these in-namespace functions can be chained to execute OS commands during artifact deserialization. Affected component per CPE is cpe:2.3:a:nltk:nltk (all versions prior to 3.10.3).
Know when Nltk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Full RCE gives C/I/A High, but exploitation requires the victim to load an attacker-supplied pickle artifact, so UI:R; no attacker-side privileges needed (PR:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.
Blast Radius
ecosystem impact- 6,216 pypi packages depend on nltk (3,092 direct, 3,205 indirect)
Ecosystem-wide dependent count for version 3.10.3.
Executive ViewAI
NLTK versions before 3.10.3 enable arbitrary code execution when users load attacker-crafted NLP models or tokenizers, creating critical risk for any organization using this library in production systems. An attacker can achieve complete system compromise by distributing malicious model artifacts, affecting applications that process external NLP data. Immediate identification of affected systems and protective controls are essential.
Restrict NLTK to loading only internal, cryptographically signed models; disable dynamic model loading where feasible; implement strict input validation and process sandboxing for untrusted NLP data; enable detailed logging and alerts on model loading activities; implement network segmentation to contain impact if system compromise occurs; establish an artifact provenance verification process requiring documentation of all model sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathse
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of s
Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP service
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpu
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
Exploit-DB