{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nltk/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-78683"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NLTK (3.9.4)","nltk","NLTK (\u003c 3.10.3)"],"_cs_severities":["critical"],"_cs_tags":["denial-of-service","xml-vulnerability","cve-2026-78681","deserialization","rce","nltk","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eNLTK (Natural Language Toolkit) versions prior to 3.10.0 contain a critical vulnerability in the TransitionParser.parse() method, located within the nltk/parse/transitionparser.py file. This vulnerability arises because the library uses an insecure default setting for the pickle_load() function, specifically setting restricted=False. By default, this utilizes the standard WarningUnpickler which fails to restrict class resolution during the deserialization process.\u003c/p\u003e\n\u003cp\u003eWhen an application utilizing NLTK processes an attacker-controlled or malicious model file, the deserialization of that object allows for the execution of arbitrary Python code. This occurs because the library does not utilize the provided RestrictedUnpickler for production tasks, thereby allowing gadget chains to execute within the context of the running application. This vulnerability is patched in version 3.10.0 and carries a CVSS 3.1 base score of 9.6.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary code with the full privileges of the user running the application. This could lead to full system compromise, data exfiltration, or the deployment of persistent threats depending on the service's environment. Applications that process untrusted NLTK model files are at the highest risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the NLTK library to version 3.10.0 or later across all production and development environments.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or signing for all model files processed by applications to ensure they originate from a trusted source.\u003c/li\u003e\n\u003cli\u003eAudit applications using the TransitionParser module to ensure that user-supplied input is not directly passed to the parsing engine.\u003c/li\u003e\n\u003cli\u003eRestrict application service account permissions to the principle of least privilege to minimize the impact of a potential RCE event.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T18:10:07Z","date_published":"2026-08-25T04:05:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nltk-pickle-rce/","summary":"The NLTK library versions up to 3.9.4 are vulnerable to arbitrary code execution when processing crafted model files due to unsafe pickle deserialization in the TransitionParser.parse() method.","title":"Remote Code Execution in NLTK via Unsafe Pickle Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-08-nltk-pickle-rce/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-71513"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nltk","NLTK (3.10.0)","NLTK (3.10.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["NLTK"],"content_html":"\u003cp\u003eNLTK (Natural Language Toolkit) versions before 3.10.3 contain a remote code execution vulnerability in the AllowlistUnpickler component. The vulnerability, tracked as CVE-2026-71513, stems from insufficient validation logic; while the component validates the pickle module string, it fails to validate the global name. This oversight allows an attacker to resolve dotted names via attribute traversal, successfully bypassing the allowlist.\u003c/p\u003e\n\u003cp\u003eBy crafting and providing a malicious transition-parser model, an attacker can trigger arbitrary command execution when the \u003ccode\u003eTransitionParser.parse\u003c/code\u003e method invokes \u003ccode\u003eallowlisted_pickle_load\u003c/code\u003e. Because this involves the deserialization of untrusted data (CWE-502), any application utilizing NLTK to load untrusted transition-parser models is at risk. Defenders should prioritize updating NLTK to version 3.10.3 or later to remediate the flaw in the underlying pickle security logic.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker generates a malicious transition-parser model file using crafted pickle payloads.\u003c/li\u003e\n\u003cli\u003eAttacker leverages attribute traversal to reference callables outside the intended allowlisted namespace.\u003c/li\u003e\n\u003cli\u003eAttacker delivers the malicious model to a target application that uses the NLTK library.\u003c/li\u003e\n\u003cli\u003eTarget application invokes the \u003ccode\u003eTransitionParser.parse\u003c/code\u003e function, which subsequently calls \u003ccode\u003eallowlisted_pickle_load\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAllowlistUnpickler\u003c/code\u003e fails to perform validation on the global name during deserialization.\u003c/li\u003e\n\u003cli\u003eThe pickle loader executes the attacker-supplied malicious callable.\u003c/li\u003e\n\u003cli\u003eArbitrary code executes within the context of the application process, leading to full system compromise or exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution, which can lead to complete compromise of the affected application environment. Given the widespread use of NLTK in data science and NLP pipelines, this vulnerability could impact numerous downstream services and automated systems that process user-provided model files. The CVSS 3.1 base score of 8.8 indicates a high severity rating with potential for full confidentiality, integrity, and availability impact.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security and engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade NLTK to version 3.10.3 or later across all environments where natural language processing tasks are performed.\u003c/li\u003e\n\u003cli\u003eAudit existing infrastructure to identify applications that load externally provided transition-parser models.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sandboxing for any component that processes serialized Python objects or untrusted model files.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for unexpected process spawns or network connections originating from Python environments using NLTK.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-27T19:14:07Z","date_published":"2026-08-22T15:31:03Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nltk-rce/","summary":"NLTK versions prior to 3.10.3 are vulnerable to remote code execution due to improper validation of dotted names during the unpickling of transition-parser models.","title":"Remote Code Execution in NLTK AllowlistUnpickler","url":"https://feed.craftedsignal.io/briefs/2026-08-nltk-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nltk:nltk:3.9.4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-12243"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nltk"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eNLTK (Natural Language Toolkit) versions prior to 3.10.0 contain a critical path traversal vulnerability (CVE-2026-12243) in the \u003ccode\u003enltk.data.load()\u003c/code\u003e and \u003ccode\u003enltk.data.find()\u003c/code\u003e functions. The vulnerability exists because the library performs security validation checks on a user-supplied \u003ccode\u003eresource_name\u003c/code\u003e string before decoding percent-encoded sequences using \u003ccode\u003eurl2pathname()\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAn attacker can bypass these safety checks by supplying encoded traversal sequences (e.g., \u003ccode\u003e%2e%2e\u003c/code\u003e instead of \u003ccode\u003e..\u003c/code\u003e). Because the security validation logic operates on the encoded input, the malicious path is permitted. Once the internal validation is cleared, \u003ccode\u003eurl2pathname()\u003c/code\u003e decodes the sequence to \u003ccode\u003e..\u003c/code\u003e, enabling the function to resolve paths outside of the intended NLTK data directory. This allows an attacker to read any file on the filesystem accessible by the application process, including sensitive credentials, configuration files, and SSH keys.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized access to sensitive system files. In environments where an application exposes functionality that accepts user-defined resource paths to the NLTK library (such as an NLTK-based web scraper or NLP analysis service), an unauthenticated or low-privileged attacker can exfiltrate arbitrary files. This may lead to credential theft, full server compromise, or unauthorized access to protected application data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003enltk\u003c/code\u003e library to version 3.10.0 or later immediately to patch CVE-2026-12243.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003enltk.data.load()\u003c/code\u003e or \u003ccode\u003enltk.data.find()\u003c/code\u003e to determine if user-controlled input is passed directly to these functions without external sanitization.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement a wrapper around \u003ccode\u003enltk.data.load()\u003c/code\u003e that manually performs URL decoding (\u003ccode\u003eurllib.parse.unquote\u003c/code\u003e) on the input path before any other processing or validation occurs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-14T02:03:36Z","date_published":"2026-08-14T02:03:36Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nltk-path-traversal/","summary":"NLTK versions prior to 3.10.0 are vulnerable to path traversal (CVE-2026-12243) due to improper sequence decoding in nltk.data.load(), allowing attackers to read arbitrary files.","title":"Arbitrary File Read in NLTK via Path Traversal","url":"https://feed.craftedsignal.io/briefs/2026-08-nltk-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Nltk","version":"https://jsonfeed.org/version/1.1"}