A critical (CVSS 9.6) unsafe deserialization flaw in the Natural Language Toolkit lets an attacker-crafted model file execute arbitrary Python code when parsed, affecting all NLTK versions up to and including 3.9.4.
What Is It
CVE-2026-78683 is a CWE-502 unsafe pickle deserialization vulnerability in NLTK's TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, which routes deserialization through WarningUnpickler. That unpickler does not override find_class(), so it permits arbitrary class resolution during load. NLTK also ships a RestrictedUnpickler intended for safe deserialization; it does not appear to be engaged on this code path, though the extent to which other paths rely on it is not established here.
The practical result: when an application loads an attacker-supplied model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application.
Why It Matters
VulnCheck assigns a CVSS 3.1 base score of 9.6 CRITICAL (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and a CVSS 4.0 score of 9.4. Attack vector is network, attack complexity is low, and no privileges are required; the only precondition is that a user or application loads the malicious model. Scope is changed, meaning impact extends beyond the vulnerable component, with high confidentiality, integrity, and availability impact both to the vulnerable system and to downstream systems.
Because NLTK model files are routinely fetched, shared, and cached across ML pipelines, "loading a model" is a normal, low-suspicion operation; which is exactly what makes deserialization bugs like this effective.
No exploit maturity is defined in the supplied CVSS 4.0 metrics, and there is no confirmation of active exploitation in the source data.
What's Vulnerable
- Vendor/product: nltk / nltk (
pkg:pypi/nltk) - Affected: all versions below 3.10.0 (explicitly
<= 3.9.4) - Unaffected: 3.10.0 and later
- Vulnerable code path:
TransitionParser.parse()innltk/parse/transitionparser.py
Patch Status
Fixed in NLTK 3.10.0. Upgrade to 3.10.0 or later. Where an immediate upgrade is not possible, treat model files as untrusted input: restrict loading to artifacts from known-good sources, verify integrity before parsing, and avoid deserializing models supplied by users or fetched from uncontrolled locations.
Sources
- NLTK GitHub Security Advisory (GHSA-rhp5-r9x4-f5g2), https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2
- VulnCheck Advisory; https://www.vulncheck.com/advisories/nltk-before-remote-code-execution-via-unsafe-pickle-deserialization