NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.

NLTK versions before 3.10.3 contain a critical remote code execution vulnerability in their allowlisted pickle loaders. The flaw exists because the loaders trust entire module namespaces rather than restricting access to specific safe callables. Attackers can craft malicious pickle payloads that invoke dangerous functions such as ReppTokenizer._execute and numpy.f2py.crackfortran.myeval via the pickle REDUCE opcode. Exploitation occurs during the loading of model or tokenizer artifacts, making supply chain and model-sharing scenarios particularly risky. The vulnerability allows arbitrary command execution on affected systems. Users are urged to upgrade to NLTK 3.10.3 or later to remediate the issue. Details are available via NVD, the NLTK GitHub security advisory, and VulnCheck.