CVE-2024-39705: Critical severity pip/nltk vulnerability
Natural Language Toolkit (NLTK) could allow a remote attacker to execute arbitrary code on the system, caused by a flaw when an untrusted packages have pickled Python code, and the integrated data package download functionality is used. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averagedperceptrontagger and punkt.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39705?
CVE-2024-39705 is considered to have a high severity due to the potential for remote code execution.
How do I fix CVE-2024-39705?
To fix CVE-2024-39705, upgrade the Natural Language Toolkit (NLTK) to version 3.9 or later.
What causes CVE-2024-39705?
CVE-2024-39705 is caused by a vulnerability that allows untrusted packages containing pickled Python code to execute arbitrary code during the data package download process.
Who is affected by CVE-2024-39705?
Users of NLTK versions prior to 3.9 are affected by CVE-2024-39705.
How can an attacker exploit CVE-2024-39705?
An attacker could exploit CVE-2024-39705 by sending a specially crafted request that triggers the execution of arbitrary code from untrusted pickled packages.