CVE-2026-78683

## Summary The NLTK library's `TransitionParser.parse()` method deserializes model files using `pickle_load()` with the default `restricted=False` parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a `RestrictedUnpickler` class for safe deserialization, but it is never used by production code paths, leaving the vulnerability unpatched. ## Root Cause **File:** `nltk/parse/transitionparser.py` (lines 542-557) The `parse()` method calls `pickle_load(f)` without `restricted=True`, routing through `WarningUnpickler` which inherits from `pickle.Unpickler` and does NOT override `find_class()`. This allows arbitrary class/function resolution during unpickling, enabling RCE via standard pickle gadgets (e.g., `os.system`, `subprocess.Popen`). **Vulnerability chain in `nltk/picklesec.py`:** ```python def pickle_load(file, *, context=None, restricted=False): if restricted: return RestrictedUnpickler(file).load() # Safe: blocks all globals return WarningUnpickler(file, context=context).load() # VULNERABLE PATH ``` `WarningUnpickler` only emits a warning but does NOT block unsafe class loading — it calls `super().load()` which is standard `pickle.Unpickler.load()`. **Why this is not by design:** - NLTK intentionally created `RestrictedUnpickler` to block unsafe deserialization - The `restricted=True` parameter exists in the API but is **never used** by any production code path - All call sites use the default `restricted=False`: `transitionparser.py:557`, `parse/chartparser_app.py:816`, `parse/chartparser_app.py:2273`, `parse/chartparser_app.py:2311` ## Attack Surface **Entry point:** `TransitionParser().parse(depgraphs, modelFile)` receives a filesystem path with no validation. **Exploitation path:** 1. Attacker places a malicious pickle file at a known or attacker-controlled location 2. Victim calls `parser.parse(sentences, "/path/to/malicious_model.pkl")` 3. `pickle_load()` deserializes the