Remote Code Execution in NLTK AllowlistUnpickler

NLTK (Natural Language Toolkit) versions before 3.10.3 contain a remote code execution vulnerability in the AllowlistUnpickler component. The vulnerability, tracked as CVE-2026-71513, stems from insufficient validation logic; while the component validates the pickle module string, it fails to validate the global name. This oversight allows an attacker to resolve dotted names via attribute traversal, successfully bypassing the allowlist.

By crafting and providing a malicious transition-parser model, an attacker can trigger arbitrary command execution when the TransitionParser.parse method invokes allowlisted_pickle_load. Because this involves the deserialization of untrusted data (CWE-502), any application utilizing NLTK to load untrusted transition-parser models is at risk. Defenders should prioritize updating NLTK to version 3.10.3 or later to remediate the flaw in the underlying pickle security logic.

Attack Chain

1. Attacker generates a malicious transition-parser model file using crafted pickle payloads.
2. Attacker leverages attribute traversal to reference callables outside the intended allowlisted namespace.
3. Attacker delivers the malicious model to a target application that uses the NLTK library.
4. Target application invokes the TransitionParser.parse function, which subsequently calls allowlisted_pickle_load.
5. The AllowlistUnpickler fails to perform validation on the global name during deserialization.
6. The pickle loader executes the attacker-supplied malicious callable.
7. Arbitrary code executes within the context of the application process, leading to full system compromise or exfiltration.

Impact

Successful exploitation allows for remote code execution, which can lead to complete compromise of the affected application environment. Given the widespread use of NLTK in data science and NLP pipelines, this vulnerability could impact numerous downstream services and automated systems that process user-provided model files. The CVSS 3.1 base score of 8.8 indicates a high severity rating with potential for full confidentiality, integrity, and availability impact.

Recommendation

Prioritized actions for security and engineering teams:

• Upgrade NLTK to version 3.10.3 or later across all environments where natural language processing tasks are performed.
• Audit existing infrastructure to identify applications that load externally provided transition-parser models.
• Implement strict input validation and sandboxing for any component that processes serialized Python objects or untrusted model files.
• Monitor application logs for unexpected process spawns or network connections originating from Python environments using NLTK.