CVE-2026-78683

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.

• CWE-502

• https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2Exploit, Vendor Advisory
• https://www.vulncheck.com/advisories/nltk-before-remote-code-execution-via-unsafe-pickle-deserializationThird Party Advisory
• https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2Exploit, Vendor Advisory

Published

Aug 25, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78678GitPython versions before 3.1.59 contain an incomplete denyl…6.5
• CVE-2026-78679GitPython before 3.1.59 contains an arbitrary file read vuln…6.5
• CVE-2026-7868IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 throu…6.5
• CVE-2026-78680NLTK versions before 3.10.3 fail to use validated absolute p…7.8
• CVE-2026-78681NLTK versions before 3.10.3 use xml.etree.ElementTree to par…7.5
• CVE-2026-78682NLTK before 3.10.3 contains a server-side request forgery vu…7.5
• CVE-2026-78684vLLM before 0.27.0 fails to properly classify DeepStream as …5.3
• CVE-2026-78685Medical Practice Management System developed by Le-yan has a…8.8
• CVE-2026-78689Description NGINX JavaScript (njs) has a vulnerability in …8.1
• CVE-2026-7869IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path …5.4
• CVE-2026-78691Improper Neutralization of Special Elements in Data Query Lo…2.1
• CVE-2026-78693Generation of Error Message Containing Sensitive Information…6.9