critical9.8
CVE-2024-39705
ntlk unsafe deserialization vulnerability
Impact
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | nltk | < 3.9 | 3.9 |
Affected products
| Product | Affected versions |
|---|---|
| NLTK | through 3.8.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nltk/nltk/issues/2522
- https://github.com/nltk/nltk/issues/3266
- https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
- https://github.com/advisories/GHSA-cgvx-9447-vcch
- https://nvd.nist.gov/vuln/detail/CVE-2024-39705
- https://github.com/nltk/nltk/commit/441aecb7d33014bd08672232c6c8bb69c2ceaba2
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2024-167.yaml