{"cve":"CVE-2026-71513","nvd":{"published":"2026-08-22T14:16:33.417","modified":"2026-10-14T19:10:00.297","status":"Analyzed","description":"NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-502"],"references":["https://github.com/nltk/nltk","https://github.com/nltk/nltk/blob/v3.10.2/nltk/picklesec.py#L119-L124","https://github.com/nltk/nltk/commit/c3e37113742a1ebeeb4f2ca58941f320f98805ea","https://www.vulncheck.com/advisories/nltk-through-remote-code-execution-via-allowlistunpickler-dotted-name-bypass"],"products":["nltk:nltk"],"source":"nvd","synced_at":"2026-10-19T22:49:38.260478770+00:00"},"epss":{"cve":"CVE-2026-71513","score":0.01097,"percentile":0.65371,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-5gh2-94qg-qppq","url":"https://osv.dev/vulnerability/GHSA-5gh2-94qg-qppq","summary":"NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution","modified":"2026-09-10T12:25:33.900504877Z","packages":[{"ecosystem":"PyPI","name":"nltk","purl":"pkg:pypi/nltk","ranges":[">=3.10.0 <3.10.3"],"fixed":["3.10.3"]}]},{"id":"PYSEC-2026-3867","url":"https://osv.dev/vulnerability/PYSEC-2026-3867","summary":"NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution","modified":"2026-09-10T12:15:07.208763276Z","packages":[{"ecosystem":"PyPI","name":"nltk","purl":"pkg:pypi/nltk","ranges":[">=3.10.0 <3.10.3"],"fixed":["3.10.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}