CVE-2026-78683: NLTK Unsafe Pickle Deserialization RCE

CVE-2026-78683 Overview

CVE-2026-78683 is an unsafe pickle deserialization vulnerability in the Natural Language Toolkit (NLTK) library affecting versions up to and including 3.9.4. The flaw resides in the TransitionParser.parse() method in nltk/parse/transitionparser.py, which invokes pickle_load() with restricted=False. This routes deserialization through WarningUnpickler, allowing arbitrary class resolution during model loading. Attackers who supply a crafted model file can execute arbitrary Python code with the privileges of the application process. The issue is tracked under [CWE-502] and fixed in NLTK 3.10.0.

Critical Impact
Loading an attacker-supplied NLTK transition parser model triggers arbitrary Python code execution through embedded pickle gadget chains.

Affected Products

NLTK versions <= 3.9.4
Applications invoking TransitionParser.parse() with untrusted model files
Downstream NLP pipelines bundling vulnerable NLTK releases

Discovery Timeline

2026-08-25 - CVE-2026-78683 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78683

Vulnerability Analysis

The vulnerability originates in NLTK's transition parser model loader. The TransitionParser.parse() method calls pickle_load() without enabling the library's restricted mode. As a result, deserialization proceeds through WarningUnpickler, which does not override find_class(). Any Python class referenced by the serialized stream resolves and instantiates during unpickling.

Python's pickle module executes callables named in the byte stream. An attacker can embed a gadget chain that invokes os.system, subprocess.Popen, or similar primitives during the __reduce__ protocol handling. Execution occurs before parsing logic runs, so a single parse() call on a malicious model achieves code execution.

NLTK ships a RestrictedUnpickler designed to constrain class resolution to a safe allowlist. Production code paths in the transition parser do not use it. The fix in version 3.10.0 routes deserialization through the restricted unpickler.

Root Cause

The root cause is insecure deserialization [CWE-502]. pickle_load() defaults to restricted=False, and WarningUnpickler inherits the unsafe default behavior of Python's stock Unpickler.find_class(). Trust boundaries are not enforced on model file inputs.

Attack Vector

Exploitation requires an application to load a model file controlled by an attacker. Delivery vectors include supply-chain compromise of published model repositories, user-uploaded models in NLP-as-a-service platforms, and phishing lures directing users to open crafted .pickle model files. User interaction is required to trigger the vulnerable code path.

The vulnerability is described in prose only; refer to the GitHub Security Advisory GHSA-rhp5-r9x4-f5g2 and the VulnCheck Advisory on NLTK for technical detail.

Detection Methods for CVE-2026-78683

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running NLTK workloads, such as sh, bash, powershell, or curl.
Outbound network connections from Python processes immediately following calls to TransitionParser.parse().
Model files (.pickle, .pkl) originating from untrusted sources or introduced outside the standard deployment pipeline.

Detection Strategies

Inventory Python environments and flag installations where nltk version is <= 3.9.4 using pip list or SBOM tooling.
Instrument application code paths that call nltk.parse.transitionparser and log the provenance of every model file loaded.
Scan pickle files for suspicious opcodes such as GLOBAL, REDUCE, and references to os, subprocess, builtins.eval, or builtins.exec prior to loading.

Monitoring Recommendations

Alert on Python processes executing shell interpreters or writing to sensitive paths shortly after model deserialization.
Monitor package registries and internal artifact stores for unauthorized changes to NLTK model files.
Correlate file-write events for .pickle artifacts with the user or service account that produced them.

How to Mitigate CVE-2026-78683

Immediate Actions Required

Upgrade NLTK to version 3.10.0 or later across all Python environments.
Audit application code for calls to TransitionParser.parse() and validate the origin of every model file consumed.
Revoke and rotate any credentials accessible to processes that previously loaded untrusted models.

Patch Information

The maintainers fixed CVE-2026-78683 in NLTK 3.10.0 by routing TransitionParser deserialization through the existing RestrictedUnpickler. See the GitHub Security Advisory GHSA-rhp5-r9x4-f5g2 for commit references and release notes.

Workarounds

Restrict model loading to files signed and hosted on trusted internal repositories.
Run NLTK workloads under least-privilege service accounts inside sandboxed containers with no outbound network egress.
Pre-scan pickle files with a custom Unpickler subclass that overrides find_class() to allowlist only NLTK's expected classes.

bash

# Upgrade NLTK to the patched release
pip install --upgrade 'nltk>=3.10.0'

# Verify the installed version
python -c "import nltk; print(nltk.__version__)"