Executive brief
NLTK is a popular Python library for natural language processing that loads model and tokenizer artifacts from pickled files. Attackers who control these artifacts can execute arbitrary commands on systems using vulnerable versions, despite the library's attempt to use "safe" pickle allowlists. The vulnerability defeats the protection mechanism designed to prevent this attack, creating a false sense of security.
Technical details
This is a deserialization vulnerability (CWE-502) in NLTK's pickle allowlist implementation. The root cause is that the allowlist mechanism trusts entire module namespaces rather than exact safe class/function pairs. Attackers can craft malicious pickles using pickle's REDUCE opcode to invoke dangerous in-namespace callables: `nltk.tokenize.repp.ReppTokenizer._execute()` (exposes subprocess.Popen) via punkt_pickle_load(), and `numpy.f2py.crackfortran.myeval()` (exposes eval) via TransitionParser.parse(). The attack requires the application to load an attacker-controlled tokenizer or model file through affected public loaders. Exploitation achieves arbitrary code execution with the privileges of the Python process. Fix: version 3.10.3+ replaces broad namespace allowlists with exact (module, qualname) pairs and implements defense-in-depth module/builtin denial before the allowlist check.
Affected products
- NLTK NLTK <= 3.10.2
Timeline
- 2026-09-08: disclosed: GitHub Advisory GHSA-x99w-6fgc-pmfw published
- 2026-09-08: patched: Version 3.10.3 released with fixes
- 2026-08-11: other: Initial GitHub review