# CVE-2026-79657: NLTK remote code execution via unsafe pickle deserialization

Source: https://junglewise.ai/threats/cve-2026-79657-nltk-remote-code-execution-via-unsafe-pickle-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79657 · Severity: critical · CVSS 9.8 · Published 2026-08-25

NLTK is a popular Python library for natural language processing that loads model and tokenizer artifacts from pickled files. Attackers who control these artifacts can execute arbitrary commands on systems using vulnerable versions, despite the library's attempt to use "safe" pickle allowlists. The vulnerability defeats the protection mechanism designed to prevent this attack, creating a false sense of security.

Technologies: [nltk (PyPI)](https://junglewise.ai/threats/technologies/nltk). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-79657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79657 being exploited in the wild.

**How severe is CVE-2026-79657?** Critical severity, with a CVSS score of 9.8, published 25 August 2026.

**Which products and versions are affected?** nltk (PyPI) <= 3.10.2, ECOSYSTEM:introduced=0,fixed=3.10.3.

**Is there a fix for CVE-2026-79657?** Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79657 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79657?** Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nltk (PyPI): upgrade to 3.10.3 or later

  ```sh
  pip install "nltk>=3.10.3"
  ```


## Technical details

This is a deserialization vulnerability (CWE-502) in NLTK's pickle allowlist implementation. The root cause is that the allowlist mechanism trusts entire module namespaces rather than exact safe class/function pairs. Attackers can craft malicious pickles using pickle's REDUCE opcode to invoke dangerous in-namespace callables: `nltk.tokenize.repp.ReppTokenizer._execute()` (exposes subprocess.Popen) via punkt_pickle_load(), and `numpy.f2py.crackfortran.myeval()` (exposes eval) via TransitionParser.parse(). The attack requires the application to load an attacker-controlled tokenizer or model file through affected public loaders. Exploitation achieves arbitrary code execution with the privileges of the Python process. Fix: version 3.10.3+ replaces broad namespace allowlists with exact (module, qualname) pairs and implements defense-in-depth module/builtin denial before the allowlist check.

## Affected products

- NLTK NLTK <= 3.10.2

## Identifiers

- CVE-2026-79657
- GHSA-x99w-6fgc-pmfw
- PYSEC-2026-3735

## Timeline

- 2026-09-08: disclosed: GitHub Advisory GHSA-x99w-6fgc-pmfw published
- 2026-09-08: patched: Version 3.10.3 released with fixes
- 2026-08-11: other: Initial GitHub review

## References

- [https://api.github.com/users/leduckhuong](https://api.github.com/users/leduckhuong)
- [https://github.com/leduckhuong](https://github.com/leduckhuong)
- [https://api.github.com/users/leduckhuong/gists%7B/gist_id%7D](https://api.github.com/users/leduckhuong/gists%7B/gist_id%7D)
- [https://api.github.com/users/leduckhuong/repos](https://api.github.com/users/leduckhuong/repos)
- [https://avatars.githubusercontent.com/u/86466393?v=4](https://avatars.githubusercontent.com/u/86466393?v=4)
- [https://api.github.com/users/leduckhuong/events%7B/privacy%7D](https://api.github.com/users/leduckhuong/events%7B/privacy%7D)

## Related threats

- [NLTK WekaClassifier path traversal in model validation](https://junglewise.ai/threats/cve-2026-109956-nltk-through-3-10-3-contains-a-path-traversal-vulnerability-in)
- [NLTK RecursiveDescentParser uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-12876-nltk-recursivedescentparser-uncontrolled-recursion-denial-of)
- [NLTK tgrep regular expression denial of service](https://junglewise.ai/threats/nltk-tgrep-regular-expression-denial-of-service-02fca1b2)
- [NLTK Downloader hardlink filesystem containment bypass](https://junglewise.ai/threats/nltk-downloader-hardlink-filesystem-containment-bypass-522cb97d)
- [NLTK Pl196xCorpusReader quadratic ReDoS on malformed TEI blocks](https://junglewise.ai/threats/nltk-pl196xcorpusreader-quadratic-redos-on-malformed-tei-blocks-8473e6ef)