CVE-2026-79657

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-79657

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-79657

NLTK (Python Natural Language Toolkit) versions before 3.10.3 are affected by a remote code execution vulnerability in its allowlisted pickle deserialization mechanism. The root cause is that the safe pickle loaders trust entire module namespaces rather than restricting to specific safe callables...

CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-78683

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

DEBIAN-CVE-2026-78683

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

CVE-2026-78683

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

CVE-2026-78683

NLTK versions ≤3.9.4 contain an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with restricted=False, routing through WarningUnpickler , which does not override find_class() and thus permits arbit...

CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

PT-2026-81158

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0 Description An unsafe pickle deserialization issue exists in the TransitionParser.parse function. The function utilizes pickle load with the restricted parameter set to False, which directs deserialization through...

Linux Distros Unpatched Vulnerability : CVE-2026-78683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method...

CVE-2026-76843

CVE-2026-76843 affects the official Flair wheels for versions 0.15.0 and 0.15.1 . The file flair/models/clustering.py remains present in the distributed package despite being removed from the documented API. Its ClusteringModel.load static method deserializes via pickle.loads(joblib.load(str(mode...

EUVD-2026-64849

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

CVE-2026-76843 Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

Insecure Default Initialization of Resource

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via disabled security enforcement in pathsec.py. An attacker can bypass protections against path...

GHSA-5GH2-94QG-QPPQ NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...

CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...