Gptline: NLTK: Allowlisted pickle loaders still permit code execution in current source (CVE-2026-79657)

The vulnerability CVE-2026-79657 involves unsafe deserialization in NLTK's allowlisted pickle loaders, which currently allow arbitrary code execution by trusting broad module namespaces instead of specific safe globals. This enables attackers to craft pickle payloads that exploit dangerous callables such as nltk.tokenize.repp.ReppTokenizer._execute and numpy.f2py.crackfortran.myeval during unpickling. The affected functions include nltk.picklesec.allowlisted_pickle_load, nltk.tokenize.punkt.punkt_pickle_load, and nltk.parse.transitionparser.TransitionParser.parse, with affected versions including the current source v3.10.0-rc2 and versions prior to 3.10.3. The root cause is the overly broad allowlist that includes entire namespaces like nltk.tokenize and numpy, exposing unsafe callables. The vulnerability allows remote code execution when loading attacker-controlled model or tokenizer artifacts. The patch replaces broad module-prefix allowlists with exact (module, qualname) pairs, denies dangerous modules such as os, subprocess, builtins, and numpy.f2py, and enforces strict checks in find_class to block dotted names and dangerous modules. This fix effectively blocks the demonstrated exploits while allowing legitimate loads to function.

This vulnerability allows remote attackers to execute arbitrary code during the deserialization of pickle objects via NLTK's allowlisted pickle loaders. Any application that loads attacker-controlled tokenizer or model artifacts using these loaders is at risk. The vulnerability defeats the intended safety mechanism of allowlisted deserialization, creating a false sense of security and enabling command execution through dangerous callables within trusted namespaces. This can lead to full system compromise or unauthorized actions within the affected environment.

A patch is available that tightens the allowlist to exact (module, qualname) pairs instead of broad module namespaces. The patch also denies dangerous modules such as os, subprocess, builtins, and numpy.f2py even if they appear in allowed modules, providing a defense-in-depth backstop. Users should upgrade to version 3.10.3 or later where these fixes are implemented. Until patched, avoid loading untrusted pickle data with the affected NLTK loaders. The vendor advisory confirms the patch and recommends replacing broad allowlists with precise safe globals and modules.