TI-2026-54695 Aliases CVE-2026-78683 GHSA-rhp5-r9x4-f5g2

NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization

HIGH 76CWE-502Published 2026-08-25 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0051 43rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial nltk (nltk): 3.10.0nltk (PyPI): 3.10.0Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nltk	nltk	before 3.10.0	3.10.0	Patch available	CNA
—	nltk (PyPI)	before 3.10.0	3.10.0	Patch available	GHSA-rhp5-r9x4-f5g2

nltk Vendornltk Affected before 3.10.0 Fixed in 3.10.0 Patch available CNA
nltk (PyPI) Vendor— Affected before 3.10.0 Fixed in 3.10.0 Patch available GHSA-rhp5-r9x4-f5g2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nltk:nltk::::::::	before 3.10.0	Vulnerable	nltk

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:* Versions before 3.10.0 Vulnerable ·nltk

Remediation

Fix · CNA nltk (nltk) Fixed in 3.10.0
Fix · GHSA-rhp5-r9x4-f5g2 nltk (PyPI) Fixed in 3.10.0 Advisory →

Red Hat 1 advisory

RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
RHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Lightspeed Core	Affected	No fix yet
OpenShift Lightspeed	Affected	No fix yet
Red Hat Ansible Automation Platform 2	Affected	No fix planned: Will not fix
Red Hat OpenShift AI 3.4	Fixed	RHSA-2026:84734

Not affected: 4 products

Lightspeed Core
OpenShift Lightspeed
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift AI 3.4

Timeline

2026-10-02 Threatist record created from CVE-2026-78683
2026-10-03 Alias added: GHSA-rhp5-r9x4-f5g2
2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat

References

Exploit 1

GitHub Security Advisory (GHSA-rhp5-r9x4-f5g2)

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-78683

Other 5

TI-2026-00629 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading CVSS 3.0CRITICAL 10.0
TI-2025-12800 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution CVSS 3.0CRITICAL 10.0
TI-2026-55173 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options CVSS 4.0CRITICAL 9.3
TI-2026-55155 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization CVSS 4.0CRITICAL 9.3
TI-2026-56370 nltk PorterStemmer before 3.10.3 Quadratic-time DoS CVSS 4.0HIGH 8.7
TI-2026-55172 NLTK 3.10.2 Path Traversal via corpus-reader constructors CVSS 4.0HIGH 8.8

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences