Bug 2523372 (CVE-2026-79657)

Summary: CVE-2026-79657 nltk: NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: anpicker, bparees, dschmidt, ebourniv, hasun, ikhan, jfula, jlanda, jowilson, kshier, nyancey, ometelka, ptisnovs, rbobbitt, sbunciak, simaishi, stcannon, syedriko, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in NLTK. This vulnerability allows a remote attacker to achieve arbitrary code execution by supplying a specially crafted model or tokenizer artifact for the application to process. The issue occurs because the deserialization allowlist mechanism permits entire software namespaces rather than restricting execution to specific safe functions, allowing dangerous internal commands to run during data loading.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2543417, 2543418    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-25 11:43:08 UTC
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.