NLTK TransitionParser Unsafe Pickle Deserialization Allows Remote Code Execution

What's on the official record

The OSV advisory GHSA-rhp5-r9x4-f5g2 reports a CRITICAL vulnerability in the PyPI package nltk, aliased as CVE-2026-78683 and classified under CWE-502. The NLTK library's TransitionParser.parse() method deserializes model files using pickle_load() with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The advisory names 3.10.0 as the fixed version and is dated 8 September 2026.

Assessment

For a platform or AI-stack owner, the record lets you check whether any deployed nltk version is below 3.10.0 and whether TransitionParser.parse() is reachable with model files from an untrusted source. The advisory names a fixed version, so the decision is to patch to 3.10.0 or pull the affected version where the parser loads externally supplied models.

For a deal team, the record lets you scope diligence on any target whose product or pipeline depends on nltk below 3.10.0, and condition or price on whether the fix has been applied. The advisory names a fixed version, so the diligence question is whether the target's dependency manifest pins nltk at or above 3.10.0.

What would change this call

A revised advisory that names a different or additional fixed version, or that narrows the affected versions, would change the patch and diligence scope. A statement from the maintainers that the affected code path is unreachable in a given configuration would also change the call.

What to check next

Confidence

Filed 25 October 2026 from the record dated 8 September 2026.

Sources

[1] NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution — https://github.com/advisories/GHSA-rhp5-r9x4-f5g2