Is CVE-2026-71513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71513 being exploited in the wild.

How severe is CVE-2026-71513?

High severity, with a CVSS score of 8.8, published 22 August 2026.

Which products and versions are affected?

nltk (PyPI) >= 3.10.0, < 3.10.3, ECOSYSTEM:introduced=3.10.0,fixed=3.10.3.

Is there a fix for CVE-2026-71513?

Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71513 attacked?

It is attacked over the network.

Am I affected by CVE-2026-71513?

Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71513: NLTK AllowlistUnpickler dotted-name validation bypass

Q: Is there a fix for CVE-2026-71513?

Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71513 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-71513?

Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71513 · Severity: high · CVSS 8.8 · Published 2026-08-22

NLTK is a popular Python natural language processing library used for text analysis and machine learning tasks. Versions 3.10.0 through 3.10.2 contain a critical flaw in the AllowlistUnpickler security component that fails to properly validate untrusted serialized Python objects (pickles). An attacker can craft malicious transition-parser models that execute arbitrary commands on systems loading these models, potentially compromising the entire system and any data processed by it.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71513 being exploited in the wild.
How severe is CVE-2026-71513?: High severity, with a CVSS score of 8.8, published 22 August 2026.
Which products and versions are affected?: nltk (PyPI) >= 3.10.0, < 3.10.3, ECOSYSTEM:introduced=3.10.0,fixed=3.10.3.
Is there a fix for CVE-2026-71513?: Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71513 attacked?: It is attacked over the network.
Am I affected by CVE-2026-71513?: Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nltk (PyPI): upgrade to 3.10.3 or later
```
pip install "nltk>=3.10.3"
```

Technical details

The vulnerability is a deserialization bypass (CWE-502) in NLTK's AllowlistUnpickler class, which is designed to safely load pickled objects by restricting which modules and classes can be unpickled. The flaw lies in the find_class() method's validation logic: it checks only the module name against an allowlist but fails to validate the global name itself. This allows attackers to use dotted-name attribute traversal (valid in pickle protocol ≥ 4) to reach callables outside the intended namespace—for example, crafting a pickle requesting "sklearn.os.system" to reach the dangerous os.system function. The vulnerability is triggered when TransitionParser.parse() loads a model via allowlisted_pickle_load(). Attack vector is network-based with low complexity; no authentication or privileges are required, though the attack requires the user to load a maliciously crafted model file. The fix in version 3.10.3 implements four protective guards: rejecting dotted names, rejecting dunder attributes, denying an explicit set of known-dangerous functions (numpy.load, pandas.read_pickle), and denying modules like os, subprocess, sys, and builtins outright.

Affected products

NLTK Project NLTK 3.10.0 through 3.10.2

Identifiers

CVE-2026-71513
GHSA-5gh2-94qg-qppq
PYSEC-2026-3867

Timeline

2026-08-22: disclosed: Published to GitHub Advisory Database and NVD
2026-08-10: patched: Security fix commit c3e3711 authored; fix shipped in version 3.10.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.