Remote Code Execution in NLTK via AllowlistUnpickler

Executive Summary

This vulnerability is a remote code execution (RCE) flaw in NLTK versions before 3.10.3. It exists in the AllowlistUnpickler class which only checks the pickle module string and not the global name. Attackers can bypass restrictions using dotted names to traverse attributes and access callables outside the allowlisted namespace. This allows execution of arbitrary commands when TransitionParser.parse loads a crafted untrusted model.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.3, the system is vulnerable. Review pickle file handling in applications using NLTK, particularly TransitionParser.parse and allowlisted_pickle_load functions.

Useful 0 Not Useful 0

Impact Analysis

If you use NLTK versions 3.10.0 through 3.10.2, an attacker could exploit this to run arbitrary code on your system by tricking you into loading a malicious pickle file or model. This could lead to data theft, system compromise, or further network attacks depending on your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. This may violate GDPR's data protection requirements or HIPAA's security rules for protected health information, depending on the data processed by the affected NLTK application.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later immediately. Review and restrict pickle file sources in applications. Replace AllowlistUnpickler with RestrictedUnpickler where possible. Audit all pickle loading functions for unsafe deserialization.

Useful 0 Not Useful 0