Skip to content
Threat Feed
Subscribe

Product

NLTK (< 3.10.3)

1 brief RSS
critical advisory

Remote Code Execution in NLTK via Unsafe Pickle Deserialization

The NLTK library versions up to 3.9.4 are vulnerable to arbitrary code execution when processing crafted model files due to unsafe pickle deserialization in the TransitionParser.parse() method.

NLTK +2 denial-of-service xml-vulnerability cve-2026-78681 deserialization rce python
6t 1c updated