CVE-2026-79657: NLTK Pickle Deserialization RCE Vulnerability

CVE-2026-79657 Overview

CVE-2026-79657 is a remote code execution vulnerability in the Natural Language Toolkit (NLTK) library affecting all versions before 3.10.3. The flaw resides in allowlisted pickle loaders that trust entire module namespaces rather than specific safe callables. Attackers craft malicious pickle payloads that invoke dangerous in-namespace functions such as ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through the pickle REDUCE opcode. Loading a tainted model or tokenizer artifact triggers arbitrary command execution in the host process. This weakness is classified under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Any Python application that loads NLTK model or tokenizer artifacts from untrusted sources can be coerced into executing attacker-supplied commands during deserialization.

Affected Products

NLTK versions prior to 3.10.3
Python applications and services embedding NLTK for tokenization or model loading
ML pipelines that consume third-party NLTK-compatible pickle artifacts

Discovery Timeline

2026-08-25 - CVE-2026-79657 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79657

Vulnerability Analysis

NLTK ships helper functions that load serialized models and tokenizers using Python's pickle module. To reduce the attack surface, the library implements allowlisted loaders intended to restrict which classes and callables the deserializer can reconstruct. The allowlist operates at module granularity rather than callable granularity. Any importable name inside a permitted module becomes reachable during deserialization.

Attackers exploit this design by referencing in-namespace helpers whose side effects allow command execution. Documented gadgets include ReppTokenizer._execute, which invokes a subprocess, and numpy.f2py.crackfortran.myeval, which passes attacker-controlled strings to eval. The pickle REDUCE opcode instructs the interpreter to call these callables with attacker-chosen arguments during load.

Root Cause

The root cause is coarse-grained allowlisting during pickle deserialization. Trusting an entire module namespace assumes every public and private symbol is safe to invoke with arbitrary arguments. That assumption fails whenever a permitted module contains callables that wrap subprocess, eval, exec, or comparable primitives. NLTK version 3.10.3 narrows the allowlist to specific safe callables to close this gap.

Attack Vector

Exploitation requires the target application to load a pickle artifact under attacker control. Common delivery paths include downloading tokenizer or model files from public repositories, ingesting user-uploaded artifacts in ML services, and pulling cached resources from compromised mirrors. Code execution occurs with the privileges of the loading process. See the GitHub Security Advisory GHSA-x99w-6fgc-pmfw and the VulnCheck Advisory on NLTK for technical details on the gadget chain and payload structure.

Detection Methods for CVE-2026-79657

Indicators of Compromise

Unexpected child processes spawned from Python interpreters running NLTK, particularly shells, curl, wget, or interpreter binaries
Pickle files containing references to ReppTokenizer._execute, numpy.f2py.crackfortran.myeval, or other in-namespace callables that wrap subprocess or eval
Outbound network connections initiated by Python processes immediately after loading .pkl, .pickle, or NLTK data files

Detection Strategies

Inspect pickle artifacts statically using tools such as pickletools.dis to identify REDUCE opcodes that reference sensitive callables prior to loading
Monitor process lineage to flag Python parents that spawn sh, bash, cmd.exe, or powershell.exe around artifact-loading operations
Inventory NLTK versions in build artifacts, containers, and virtual environments and alert on versions earlier than 3.10.3

Monitoring Recommendations

Enable command-line auditing on hosts that run NLTK-based services and forward events to a central analytics pipeline
Baseline network egress from ML training and inference nodes to detect anomalous callbacks after model loads
Track file provenance for tokenizer and model artifacts and alert when unsigned or externally sourced pickles are loaded

How to Mitigate CVE-2026-79657

Immediate Actions Required

Upgrade NLTK to version 3.10.3 or later across all environments, including container images and locked dependency manifests
Audit existing pickle artifacts sourced from third parties and revoke or quarantine any files whose provenance cannot be verified
Restrict outbound network access and subprocess execution for services that deserialize NLTK artifacts

Patch Information

The maintainers released NLTK 3.10.3, which replaces module-level allowlisting with a narrow allowlist of specific safe callables. Update using pip install --upgrade 'nltk>=3.10.3' and rebuild any downstream container images that pin an older version. Details are documented in the NLTK GitHub Security Advisory.

Workarounds

Refuse to load pickle artifacts from untrusted or unauthenticated sources until the upgrade is deployed
Run NLTK-consuming services under least-privilege accounts with seccomp, AppArmor, or SELinux profiles that block subprocess creation
Replace pickle-based model exchange with signed, schema-validated formats such as JSON, SafeTensors, or ONNX where feasible

bash

# Upgrade NLTK to a patched release
python -m pip install --upgrade 'nltk>=3.10.3'

# Verify installed version
python -c "import nltk; print(nltk.__version__)"