NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.

NLTK versions up to and including 3.9.4 contain an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method located in nltk/parse/transitionparser.py. The method invokes pickle_load() with the default parameter restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and thus permits arbitrary class resolution. An attacker can craft a malicious model file containing pickle gadget chains that execute arbitrary Python code with the privileges of the application user upon loading. While NLTK provides a RestrictedUnpickler class designed for safe deserialization, it is not utilized in production code paths, leaving users exposed. The vulnerability enables remote or local code execution depending on how model files are sourced and loaded. The issue has been addressed and fixed in NLTK version 3.10.0. Users are strongly advised to upgrade immediately to mitigate the risk of arbitrary code execution.