Threats tagged 'brew-acronym-cve-2026-78683'

The NLTK library's TransitionParser.parse() method insecurely deserializes model files using Python's pickle without restricting unsafe operations, allowing remote code execution (RCE) if a malicious pickle file is loaded. Although NLTK provides a RestrictedUnpickler class for safe deserialization, it is not used in production code paths, leaving the vulnerability unpatched in versions up to 3.9.4. This flaw enables attackers to execute arbitrary code with the privileges of the user running the application. The vulnerability is fixed in NLTK version 3.10.0 and later by enforcing restricted deserialization.