A namespace-level allowlist flaw in NLTK's pickle loaders lets attackers achieve remote code execution when a malicious model or tokenizer artifact is loaded, rated CVSS 9.8 (Critical).
What Is It
CVE-2026-79657 is an unsafe deserialization vulnerability (CWE-502) in NLTK versions before 3.10.3. The library's allowlisted pickle loaders trust entire module namespaces rather than a narrow set of specific safe callables. Because the allowlist is scoped to modules rather than individual callables, any function reachable inside an approved module can be invoked during deserialization.
Attackers can craft pickle payloads that use the pickle REDUCE opcode to invoke dangerous in-namespace functions, the advisory names ReppTokenizer._execute and numpy.f2py.crackfortran.myeval, to execute arbitrary commands during model or tokenizer artifact loading.
Why It Matters
Per the NVD record, the CVSS 3.1 base score is 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS 4.0 secondary score of 9.3 (Critical) is also assigned. The vector describes a network attack vector, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability.
The trigger is artifact loading; the routine act of pulling in a model or tokenizer file. Any pipeline that ingests NLTK artifacts from an untrusted or semi-trusted source is a code execution path.
What's Vulnerable
- Vendor/product: nltk / nltk
- Affected: all versions before 3.10.3
- Unaffected: 3.10.3 and later
No CPE entries were published with the NVD record at time of writing.
Patch Status
Upgrade NLTK to 3.10.3 or later. The vendor advisory (GHSA-x99w-6fgc-pmfw) is the authoritative fix reference.
This CVE does not appear in the CISA KEV catalog based on the supplied data, so there is no confirmation of active exploitation and no federal remediation deadline attached. The NVD record lists CVSS 4.0 exploit maturity as NOT_DEFINED. Absence from KEV does not indicate the vulnerability is not exploitable; the unauthenticated, no-interaction RCE profile is the driver for patch urgency.
The record was published 2026-08-25 by [email protected] and carries NVD status "Received," meaning analysis is not yet complete.
Sources
- NVD, CVE-2026-79657, https://nvd.nist.gov/vuln/detail/CVE-2026-79657
- NLTK GitHub Security Advisory (GHSA-x99w-6fgc-pmfw), https://github.com/nltk/nltk/security/advisories/GHSA-x99w-6fgc-pmfw
- VulnCheck Advisory; https://www.vulncheck.com/advisories/nltk-before-3.10.3-remote-code-execution-via-unsafe-pickle-deserialization