{"data":{"id":"0a1e27fd-8c5d-41e3-8f92-ffb7f85ed27a","title":"CVE-2026-78683: NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the Transition","summary":"NLTK (Natural Language Toolkit, a Python library for processing human language) versions 3.9.4 and earlier have a vulnerability in their TransitionParser.parse() method that allows attackers to run arbitrary code by providing a malicious model file. The problem occurs because the code uses unsafe deserialization (pickle_load, a method that converts saved Python objects back into code) without proper restrictions, so it will execute hidden malicious commands embedded in a crafted model file when the application loads it.","solution":"Update NLTK to version 3.10.0 or later, which fixes this vulnerability.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78683","publishedAt":"2026-08-25T02:16:53.033Z","cveId":"CVE-2026-78683","cweIds":["CWE-502"],"cvssScore":"9.6","cvssSeverity":"critical","severity":"critical","attackType":["model_theft","supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["NLTK"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-25T02:16:53.033Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"model","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":["AML.T0010"]}}