CVE-2026-79657

NLTK's allowlisted pickle loaders — introduced to replace unrestricted pickle loading with a safer mechanism — still permit arbitrary code execution because they allowlist entire module namespaces instead of exact safe globals, exposing dangerous callables such as nltk.tokenize.repp.ReppTokenizer._execute (a subprocess.Popen sink) and numpy.f2py.crackfortran.myeval (an attacker-controllable eval path) to pickle REDUCE. The flaw is triggered when an application loads an attacker-controlled tokenizer or model artifact through punkt_pickle_load() or through TransitionParser.parse(), which calls allowlisted_pickle_load with allowed_modules ('numpy', 'scipy', 'sklearn'). An attacker gains command execution on the host during unpickling, before the loader returns or before post-load type checks abort, defeating the protection mechanism the allowlist was designed to provide. Only deployments running the current v3.10.0-rc2 source tree and loading untrusted model or tokenizer artifacts through these loaders are affected; published 3.9.4 was not the claim target for this bypass. The issue is not yet patched, with no public proof-of-concept, no KEV listing, and an estimated 1.2% probability of exploitation within 30 days.

What to do: Until a patched release ships, do not load untrusted punkt tokenizer or transition-parser model artifacts through the new allowlisted loaders on the v3.10.0-rc2 source tree; load only artifacts from trusted sources and verify the loaded object's type immediately after unpickling. There is no fixed version to upgrade to yet, so monitor the NLTK 3.10 line for a fix that narrows the allowlists to exact (module, qualname) pairs.