Remote Code Execution Vulnerability in NLTK by Python Software Foundation

CVE-2026-71513

What is CVE-2026-71513?

A remote code execution vulnerability exists in the NLTK library versions prior to 3.10.3. The issue arises in the AllowlistUnpickler, where the library only validates the string of the pickle module, neglecting to check the global name. This oversight allows attackers to exploit dotted names via attribute traversal, gaining the ability to execute arbitrary commands by loading untrusted transition-parser models with the TransitionParser.parse method, which utilizes allowlisted_pickle_load. Attackers can potentially leverage this to execute malicious code within the application.

References