Executive brief
NLTK is a Python library used for natural language processing tasks like text parsing and tokenization. The TransitionParser.parse() method loads pre-trained parsing models from pickle files without proper safety checks, allowing an attacker to place a malicious model file and achieve remote code execution with the privileges of the application using NLTK. This affects researchers, data scientists, and automated machine learning pipelines.
Technical details
The vulnerability is a deserialization of untrusted data (CWE-502) in NLTK's pickle-based model loading. The parse() method in nltk/parse/transitionparser.py calls pickle_load(f) without the restricted=True parameter (line 557), routing through WarningUnpickler which does not override find_class() and thus permits arbitrary class/function resolution during unpickling. An attacker can craft a malicious pickle file using standard Python gadgets (e.g., os.system, subprocess.Popen) that executes arbitrary code during deserialization. The vulnerability is reachable when an application calls TransitionParser().parse() with a path to an attacker-controlled or compromised pickle file. The fix requires changing pickle_load() calls at four locations to use restricted=True, enabling RestrictedUnpickler which maintains a strict allowlist and blocks all unsafe globals.
Affected products
- NLTK Project NLTK <= 3.9.4
Timeline
- 2026-08-11: disclosed
- 2026-09-08: advisory
- 2026-09-08: patched: Fix released in NLTK 3.10.0