Remote Code Execution in NLTK via Unsafe Pickle Deserialization

NLTK (Natural Language Toolkit) versions prior to 3.10.0 contain a critical vulnerability in the TransitionParser.parse() method, located within the nltk/parse/transitionparser.py file. This vulnerability arises because the library uses an insecure default setting for the pickle_load() function, specifically setting restricted=False. By default, this utilizes the standard WarningUnpickler which fails to restrict class resolution during the deserialization process.

When an application utilizing NLTK processes an attacker-controlled or malicious model file, the deserialization of that object allows for the execution of arbitrary Python code. This occurs because the library does not utilize the provided RestrictedUnpickler for production tasks, thereby allowing gadget chains to execute within the context of the running application. This vulnerability is patched in version 3.10.0 and carries a CVSS 3.1 base score of 9.6.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the full privileges of the user running the application. This could lead to full system compromise, data exfiltration, or the deployment of persistent threats depending on the service's environment. Applications that process untrusted NLTK model files are at the highest risk.

Recommendation

1. Upgrade the NLTK library to version 3.10.0 or later across all production and development environments.
2. Implement strict input validation or signing for all model files processed by applications to ensure they originate from a trusted source.
3. Audit applications using the TransitionParser module to ensure that user-supplied input is not directly passed to the parsing engine.
4. Restrict application service account permissions to the principle of least privilege to minimize the impact of a potential RCE event.