CVE-2026-78683
CriticalCVSS 9.6Summary
NLTK before 3.10.0 contains an unsafe pickle deserialization vulnerability in TransitionParser.parse(). Deserialization uses default restricted=False, allowing arbitrary Python code execution when loading a crafted model file.
Risk Assessment
An attacker can execute arbitrary code in the context of the user running the application, potentially leading to system compromise or data theft.
Recommendation
Update NLTK to version 3.10.0 or later. Avoid loading models from untrusted sources.
Original NVD description (English source)
NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.