CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-39705
Critical (9.8). EPSS 1.3% chance of exploitation in the next 30 days. Fixed in nltk 3.9.
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cgvx-9447-vcch | PyPI | nltk | <3.9 | 3.9 |
| PYSEC-2024-167 | PyPI | nltk | <3.9 | 3.9 |