Lucene search

GoogleOSV:CVE-2024-39705

HistoryJun 27, 2024 - 10:15 p.m.

CVE-2024-39705

2024-06-2722:15:10

Google

osv.dev

nltk

remote code execution

pickled python code

untrusted packages

data package download

7.8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

CPENameOperatorVersion
nltkeq3.2.2
nltkeq3.5
nltkeq3.2.4
nltkeq3.2.5
nltkeq3.7
nltkeq3.4.4
nltkeq2.0.1rc3
nltkeq3.6.1
nltkeq2.0.1rc2
nltkeq3.6.3

Name	Operator	Version
nltk	eq	3.2.2
nltk	eq	3.5
nltk	eq	3.2.4
nltk	eq	3.2.5
nltk	eq	3.7
nltk	eq	3.4.4
nltk	eq	2.0.1rc3
nltk	eq	3.6.1
nltk	eq	2.0.1rc2
nltk	eq	3.6.3

Rows per page:

1-10 of 401

References

github.com/nltk/nltk/issues/2522

github.com/nltk/nltk/issues/3266