Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-78683 Arbitrary Python Code Execution in NLTK via Unsafe Pickle Deserialization https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-78683
Post summary
The message announces CVE‑2026‑78683, highlighting a Python code execution flaw in NLTK caused by unsafe pickle deserialization, with no evidence of PoC, exploit code, active exploitation, or patch details.
Μη ασφαλής αποσειριοποίηση στο NLTK: CVE-2026-78683 https://secn.ws/F2pO1l
Post summary
The text discloses an insecure deserialization vulnerability in NLTK (CVE-2026-78683), but no further details, PoC, or mitigation are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nltk | nltk | - | - | - |