Description

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-22T14:16:33.417Z",
  "pubdate": "2026-08-22T14:16:33.417Z",
  "executiveSummary": "A remote code execution vulnerability exists in NLTK before version 3.10.3 within the AllowlistUnpickler component.\nThe vulnerability allows attackers to execute arbitrary commands by supplying crafted untrusted transition-parser models that are subsequently loaded via allowlisted_pickle_load in TransitionParser.parse.\nThe core issue stems from insufficient validation within the unpickling mechanism, which checks only the primary pickle module string rather than the fully qualified global name.\nConsequently, attackers can leverage attribute traversal to resolve dotted names, effectively bypassing the security boundary and invoking callables situated outside the intended allowlisted namespace.\nSuccessful exploitation grants an attacker the ability to execute arbitrary system commands within the context of the application processing the malicious model.\nThis introduces severe risk implications, including complete system compromise, data exfiltration, or unauthorized modification of the underlying host environment.\nMitigation requires updating NLTK to version 3.10.3 or later, avoiding the deserialization of untrusted transition-parser models, and implementing strict input validation and sandboxing controls for serialized data processing.",
  "technicalDetails": "The vulnerability resides in the AllowlistUnpickler component of the NLTK library, specifically affecting versions prior to 3.10.3.\nThe root cause of the flaw is an incomplete validation implementation during the deserialization of pickle data. While the unpickler evaluates the primary module string, it fails to adequately inspect or restrict the global name associated with the object being constructed.\nThis oversight permits attackers to construct malicious payloads utilizing dotted names that perform attribute traversal during the find_class process.\nThrough this traversal mechanism, the unpickling routine resolves and invokes callables that exist outside of the securely intended allowlisted namespace.\nThe attack vector involves the manipulation of transition-parser models. An attacker crafts an untrusted transition-parser model containing malicious serialized instructions designed to exploit the attribute traversal flaw.\nWhen an application invokes TransitionParser.parse to load the compromised model, the execution flow delegates to allowlisted_pickle_load.\nBecause the validation check is bypassed via dotted name resolution, the Python runtime deserializes the malicious payload and executes arbitrary commands embedded within the custom model.\nThe vulnerability can be exploited without authentication if the vulnerable application automatically or unconditionally loads untrusted model files supplied by external users.\nNetwork exposure depends on the architecture of the application utilizing NLTK, but any service exposing an endpoint that processes user-supplied transition-parser models is susceptible.\nPost-exploitation impact includes arbitrary code execution, lateral movement, unauthorized access to sensitive application data, and total compromise of the host executing the NLTK parsing routines."
}