Executive brief
NLTK is a popular Python natural language processing library used for text analysis and machine learning tasks. Versions 3.10.0 through 3.10.2 contain a critical flaw in the AllowlistUnpickler security component that fails to properly validate untrusted serialized Python objects (pickles). An attacker can craft malicious transition-parser models that execute arbitrary commands on systems loading these models, potentially compromising the entire system and any data processed by it.
Technical details
The vulnerability is a deserialization bypass (CWE-502) in NLTK's AllowlistUnpickler class, which is designed to safely load pickled objects by restricting which modules and classes can be unpickled. The flaw lies in the find_class() method's validation logic: it checks only the module name against an allowlist but fails to validate the global name itself. This allows attackers to use dotted-name attribute traversal (valid in pickle protocol ≥ 4) to reach callables outside the intended namespace—for example, crafting a pickle requesting "sklearn.os.system" to reach the dangerous os.system function. The vulnerability is triggered when TransitionParser.parse() loads a model via allowlisted_pickle_load(). Attack vector is network-based with low complexity; no authentication or privileges are required, though the attack requires the user to load a maliciously crafted model file. The fix in version 3.10.3 implements four protective guards: rejecting dotted names, rejecting dunder attributes, denying an explicit set of known-dangerous functions (numpy.load, pandas.read_pickle), and denying modules like os, subprocess, sys, and builtins outright.
Affected products
- NLTK Project NLTK 3.10.0 through 3.10.2
Timeline
- 2026-08-22: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-10: patched: Security fix commit c3e3711 authored; fix shipped in version 3.10.3