CVE-2026-79657: NLTK before 3.10.3: Remote Code Execution via Unsafe Pickle Deserialization
NLTK versions before 3.10.3 contain a remote code execution flaw in allowlisted pickle loaders that trust whole module namespaces instead of specific safe callables. The record rates it critical, with CVSS 3.1 score 9.8, and classifies it as CWE-502. It is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.
Overview
NLTK versions before 3.10.3 contain a remote code execution weakness in allowlisted pickle loaders. The loaders trust whole module namespaces rather than a short list of safe callables, so pickled data can reach functions that should not be reachable during deserialization. The record classifies the issue under CWE-502, deserialization of untrusted data.
Impact
- The record describes arbitrary command execution while model or tokenizer artifacts are loaded.
- The CVSS 3.1 base score is 9.8 (critical), with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
- VulnCheck also reports a CVSS 4.0 score of 9.3.
Affected products and versions
- The record lists the product as Nltk Nltk, with versions before 3.10.3.
- The record contains no entry in its fixes list. Because 3.10.3 is the upper boundary of the affected range, upgrading to 3.10.3 or later is a reasonable inference, but this should be confirmed against the vendor advisory.
Exploitation status
- The record shows this CVE is not listed in CISA KEV.
- No confirmed exploitation in the wild appears in the sources consulted.
- The SSVC exploitation value is recorded as poc, meaning proof-of-concept material is considered to exist. One advisory reference is tagged as Exploit, but its content was not reviewed for this analysis.
- The EPSS probability is 0.01267, with a percentile of 0.69019.
Remediation and mitigation
- Upgrade NLTK to version 3.10.3 or a later release that is outside the affected range.
- Until the upgrade is applied, load model and tokenizer artifacts only from trusted and verified sources, and do not deserialize pickle data from unknown or untrusted origins.
- Where workflows allow, prefer data formats that do not execute code during parsing.
- Review the GitHub Security Advisory and the VulnCheck advisory for vendor guidance.
Detection guidance
- Inventory Python environments and dependency manifests to identify NLTK installations below 3.10.3.
- Review pipelines that load pickled artifacts and record where those artifacts originate.
- Monitor for unexpected child processes started by Python processes that load NLTK resources.
Limitations of the available information
- The record does not state an explicit fixed version or patch details beyond the affected range.
- The lower bound of the affected range is not given, so the earliest vulnerable version is unknown.
- The record does not detail exploitation prerequisites in typical deployments.
- The analysis relies only on the record and its listed references and source pages.
Frequently asked questions
Which NLTK versions are affected by this CVE?
The record lists NLTK versions before 3.10.3 as affected. The lower bound of the range is not stated in the record.
Is this vulnerability known to be exploited in the wild?
The record shows it is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation value is poc, which indicates proof-of-concept material is considered to exist.
What should administrators do now?
Upgrade NLTK to 3.10.3 or later, and until then load model and tokenizer artifacts only from trusted sources. Inventory environments to find vulnerable installations.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.