CVE-2026-79657criticalCWE-502

CVE-2026-79657: fallo crítico en nltk

NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear nltk+ Monitorear nltk

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 1.3%
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
nltk · nltk
CVEs relacionadas — nltk

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-43854HIGHInefficient Regular Expression Complexity in nltkEPSS 2.8%CVE-2026-33231HIGHNLTK has unauthenticated remote shutdown in nltk.app.wordnet_appEPSS 1.3%CVE-2026-71513HIGHNLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name BypassEPSS 1.1%CVE-2026-79675CRITICALNLTK before 3.10.3 JVM Argument Injection via Per-Call OptionsEPSS 0.8%CVE-2026-72818HIGHNLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like InputEPSS 0.7%CVE-2026-80205HIGHNLTK before 3.10.0 ReDoS via Text.findall() unvalidated regexEPSS 0.7%