NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.

NLTK versions before 3.10.3 contain a critical remote code execution vulnerability in the AllowlistUnpickler component. The flaw exists because the pickler validates only the pickle module string but not the global name, allowing attackers to bypass allowlist restrictions via dotted name attribute traversal. This enables resolution of callables outside the allowlisted namespace. Attackers can exploit this by crafting malicious transition-parser models that execute arbitrary commands when loaded via TransitionParser.parse and allowlisted_pickle_load. The vulnerability is tracked as CVE-2026-71513 and has been patched in NLTK version 3.10.3. Users are strongly advised to upgrade immediately to mitigate the risk of arbitrary command execution through untrusted model files.