Gptline: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution (CVE-2026-78683)

NLTK's TransitionParser.parse() method calls pickle_load() with the default parameter restricted=False, which uses WarningUnpickler that does not override find_class(), allowing arbitrary class/function resolution during unpickling. This enables remote code execution through crafted pickle files containing malicious payloads. The library includes a RestrictedUnpickler class designed to block unsafe deserialization, but this safe path is never invoked in production. Versions up to 3.9.4 are affected, with the vulnerability fixed in 3.10.0 by switching to restricted=True in all pickle_load calls within parsing modules.

An attacker who can supply a malicious pickle file to the TransitionParser.parse() method can achieve remote code execution with the privileges of the user running the NLTK-dependent application. This affects researchers, data scientists, and automated ML pipelines using NLTK for parsing tasks. The vulnerability allows arbitrary Python code execution during model deserialization, posing a critical security risk.

A patch is available and should be applied. The fix involves changing all pickle_load() calls in NLTK parsing modules to use restricted=True, which invokes RestrictedUnpickler and blocks unsafe deserialization. Users should upgrade to NLTK version 3.10.0 or later where this fix is implemented. No additional mitigations are required if the patched version is used.