CVE-2026-79657: NLTK remote code execution via unsafe pickle deserialization

CVE-2026-79657 · Severity: critical · CVSS 9.8 · Published 2026-08-25

NLTK is a popular Python library for natural language processing that loads model and tokenizer artifacts from pickled files. Attackers who control these artifacts can execute arbitrary commands on systems using vulnerable versions, despite the library's attempt to use "safe" pickle allowlists. The vulnerability defeats the protection mechanism designed to prevent this attack, creating a false sense of security.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-79657 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79657 being exploited in the wild.
How severe is CVE-2026-79657?
Critical severity, with a CVSS score of 9.8, published 25 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.10.2, ECOSYSTEM:introduced=0,fixed=3.10.3.
Is there a fix for CVE-2026-79657?
Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79657 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-79657?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.10.3 or later
    pip install "nltk>=3.10.3"

Technical details

This is a deserialization vulnerability (CWE-502) in NLTK's pickle allowlist implementation. The root cause is that the allowlist mechanism trusts entire module namespaces rather than exact safe class/function pairs. Attackers can craft malicious pickles using pickle's REDUCE opcode to invoke dangerous in-namespace callables: `nltk.tokenize.repp.ReppTokenizer._execute()` (exposes subprocess.Popen) via punkt_pickle_load(), and `numpy.f2py.crackfortran.myeval()` (exposes eval) via TransitionParser.parse(). The attack requires the application to load an attacker-controlled tokenizer or model file through affected public loaders. Exploitation achieves arbitrary code execution with the privileges of the Python process. Fix: version 3.10.3+ replaces broad namespace allowlists with exact (module, qualname) pairs and implements defense-in-depth module/builtin denial before the allowlist check.

Affected products

  • NLTK NLTK <= 3.10.2

Identifiers

  • CVE-2026-79657
  • GHSA-x99w-6fgc-pmfw
  • PYSEC-2026-3735

Timeline

  • 2026-09-08: disclosed: GitHub Advisory GHSA-x99w-6fgc-pmfw published
  • 2026-09-08: patched: Version 3.10.3 released with fixes
  • 2026-08-11: other: Initial GitHub review

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.