GHSA-cgvx-9447-vcch

Suggest an improvement
Source
https://github.com/advisories/GHSA-cgvx-9447-vcch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-cgvx-9447-vcch/GHSA-cgvx-9447-vcch.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-cgvx-9447-vcch
Aliases
Related
Published
2024-06-28T00:33:31Z
Modified
2025-01-21T18:47:27.017939Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ntlk unsafe deserialization vulnerability
Details

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averagedperceptrontagger and punkt.

Database specific 
{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-300",
        "CWE-502"
    ],
    "nvd_published_at": "2024-06-27T22:15:10Z",
    "github_reviewed_at": "2024-06-28T21:11:25Z",
    "github_reviewed": true
}
References

Affected packages

PyPI / nltk

Package

Name
nltk
View open source insights on deps.dev
Purl
pkg:pypi/nltk

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.9

Affected versions

2.*

2.0.1rc2-git
2.0b4
2.0b5
2.0b6
2.0b7
2.0b8
2.0b9
2.0.1rc1
2.0.1rc3
2.0.1rc4
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5

0.*

0.8
0.9
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9

3.*

3.0.0b1
3.0.0b2
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.1
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3
3.4
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.5b1
3.5
3.6
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.7
3.8
3.8.1
3.9b1