Executive brief
NLTK is a popular Python library used for natural language processing and parsing tasks. The library's TransitionParser component unsafely deserializes model files using Python's pickle format without validation, allowing an attacker to embed malicious code in a model file that executes with the privileges of the user running the application. This can lead to complete compromise of systems that load untrusted or attacker-controlled model files.
Technical details
The vulnerability exists in nltk/parse/transitionparser.py at line 557, where the parse() method calls pickle_load(f) with the default restricted=False parameter. This routes deserialization through WarningUnpickler, which inherits from pickle.Unpickler but does not override find_class(), allowing full class/function resolution during unpickling. Attackers can exploit this by crafting a pickle file containing a gadget chain (e.g., using os.system or subprocess.Popen via __reduce__) that executes arbitrary Python code when loaded. The library provides a RestrictedUnpickler class designed to safely deserialize untrusted data, but it is never used in production code paths. The fix is to change pickle_load(f) to pickle_load(f, restricted=True) at all call sites. The vulnerability is patched in version 3.10.0 and earlier.
Affected products
- NLTK Project NLTK <= 3.9.4
Timeline
- 2026-08-11: disclosed: Original advisory GHSA-rhp5-r9x4-f5g2 published
- 2026: patched: Fixed in version 3.10.0