CyberRota Analysis
AI-GeneratedNLTK versions prior to 3.10.3 are vulnerable to a remote code execution flaw in the AllowlistUnpickler, which inadequately validates the global name, enabling attackers to exploit attribute traversal and execute arbitrary commands. This vulnerability poses a significant risk to applications utilizing NLTK for parsing untrusted models, making it essential for developers and organizations using this library to prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.
Related CVEs
Other vulnerabilities affecting the same vendor(s)