GHSA-cgvx-9447-vcch

ntlk unsafe deserialization vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-39705

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	nltk	< 3.9	3.9

Details

As written in the advisory (Markdown source, shown as plain text).

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-39705 advisory
https://github.com/nltk/nltk/issues/2522 web
https://github.com/nltk/nltk/issues/3266 web
https://github.com/nltk/nltk/commit/441aecb7d33014bd08672232c6c8bb69c2ceaba2 web
https://github.com/nltk/nltk package
https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2024-167.yaml web
https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706 web