Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.6, published 25 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026: Fixed in version 3.10.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

NLTK unsafe pickle deserialization in TransitionParser

Severity: critical · CVSS 9.6 · Published 2026-08-25

NLTK is a popular Python library used for natural language processing and parsing tasks. The library's TransitionParser component unsafely deserializes model files using Python's pickle format without validation, allowing an attacker to embed malicious code in a model file that executes with the privileges of the user running the application. This can lead to complete compromise of systems that load untrusted or attacker-controlled model files.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.6, published 25 August 2026.
Which products and versions are affected?: nltk (PyPI) <= 3.9.4.
Is there a fix for This vulnerability?: A patch was published on 2026: Fixed in version 3.10.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in nltk/parse/transitionparser.py at line 557, where the parse() method calls pickle_load(f) with the default restricted=False parameter. This routes deserialization through WarningUnpickler, which inherits from pickle.Unpickler but does not override find_class(), allowing full class/function resolution during unpickling. Attackers can exploit this by crafting a pickle file containing a gadget chain (e.g., using os.system or subprocess.Popen via __reduce__) that executes arbitrary Python code when loaded. The library provides a RestrictedUnpickler class designed to safely deserialize untrusted data, but it is never used in production code paths. The fix is to change pickle_load(f) to pickle_load(f, restricted=True) at all call sites. The vulnerability is patched in version 3.10.0 and earlier.

Affected products

NLTK Project NLTK <= 3.9.4

Timeline

2026-08-11: disclosed: Original advisory GHSA-rhp5-r9x4-f5g2 published
2026: patched: Fixed in version 3.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.