GitHub Advisoryadvisory · PyPI

GHSA-cgvx-9447-vcch ntlk unsafe deserialization vulnerability

HIGH Published 2024-06-28 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-39705
Ecosystem
PyPI
Packages
nltk
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-300, CWE-502
Reviewed
2024-06-28

Affected packages

• PyPI nltk: < 3.9 → fixed in 3.9

Description

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Related

Alias · CVE (1)

  • CVE-2024-39705 NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download… vulnerability

Weakness · CWE (2)

  • CWE-300 Channel Accessible by Non-Endpoint weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References