Paper/Archive/CVE-2024-39705

CVE-2024-39705

nltk nltk — NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 71.4.714 × 2014.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

nltk≤ 3.8.1–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/nltk/nltk/issues/3266 refgithub.com/nltk/nltk/issues/2522 refvicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706