CVE-2024-39705

Published: Jun 27, 2024Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (6)

https://github.com/nltk/nltk/issues/2522

Source: cve@mitre.org

https://github.com/nltk/nltk/issues/3266

Source: cve@mitre.org

https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706

Source: cve@mitre.org

https://github.com/nltk/nltk/issues/2522

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/nltk/nltk/issues/3266

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.