{"data":{"id":"0a1e27fd-8c5d-41e3-8f92-ffb7f85ed27a","title":"CVE-2026-78683: NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the…","summary":"NLTK before 3.10.0 (affected versions <=3.9.4) has an unsafe pickle deserialization flaw in TransitionParser.parse() (nltk/parse/transitionparser.py). The method calls pickle_load() with restricted=False, routing loads through WarningUnpickler, which does not override find_class(), so arbitrary class resolution is allowed. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application.","solution":"Fixed in 3.10.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78683","publishedAt":"2026-08-25T02:16:53.033Z","cveId":"CVE-2026-78683","cweIds":["CWE-502"],"cvssScore":"9.6","cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["nltk@<= 3.9.4 (fixed: 3.10.0)"],"affectedPackageNames":["nltk"],"affectedPackageRefs":["pypi:nltk"],"affectedVendors":[],"affectedVendorsRaw":["NLTK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"NLTK unsafe pickle deserialization in TransitionParser.parse() method","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.0051,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-rhp5-r9x4-f5g2"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:44:59.061Z","patchAvailable":true,"disclosureDate":"2026-08-25T02:16:53.033Z","fixReleasedAt":"2026-07-08T02:39:09.753Z","daysToFix":-48,"fixCheckedAt":"2026-10-29T21:31:27.200Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"nltk","fixedVersion":"3.10.0","matchedVersion":"3.10.0","fixReleasedAt":"2026-07-08T02:39:09.753Z","daysToFix":-48,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:31:27.055Z"}]}}