CVE-2026-79657: NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NLTKto a version that resolves this vulnerability.Fixed in 3.10.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using NLTK versions earlier than 3.10.3 are exposed when they load model or tokenizer artifacts through the affected allowlisted pickle loaders. The risk is especially relevant where an attacker can cause a crafted artifact to be loaded.
What does an attacker need to exploit this issue?
An attacker needs to provide or make the target load a malicious pickle payload. The vulnerability has a network attack vector and requires no privileges or user interaction according to the supplied severity vector.
What is the immediate remediation?
Upgrade NLTK to version 3.10.3 or later. Until upgrading is possible, avoid loading untrusted model or tokenizer artifacts through the affected pickle-loading paths.