Every CVE Search/ Get API key

CVE-2024-39705

ntlk unsafe deserialization vulnerability

9.8 CriticalFix available

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.35%Up 1.3 points since Jun 28, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
CVE-2024-39705
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2024-0118 9.8

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
EUVD-2024-0118
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-cgvx-9447-vcch 7.5

ntlk unsafe deserialization vulnerability

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
GHSA-cgvx-9447-vcch
CVSS 4.0
7.5 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-300, CWE-502
Updated
2026-11-02
NVD 9.8

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
CVE-2024-39705
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
OSV 9.8

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
CVE-2024-39705
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-39705 9.8

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
DEBIAN-CVE-2024-39705
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-cgvx-9447-vcch 7.5

ntlk unsafe deserialization vulnerability

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
GHSA-cgvx-9447-vcch
CVSS 4.0
7.5 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-300, CWE-502
Updated
2026-11-02
OSVUBUNTU-CVE-2024-39705 9.8

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
UBUNTU-CVE-2024-39705
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:0221-1 No score

Security update for python-nltk

This update for python-nltk fixes the following issues:

  • CVE-2024-39705: Fixed remote code execution through unsafe pickle usage (boo#1227174).
Record
openSUSE-SU-2024:0221-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:0222-1 No score

Security update for python-nltk

This update for python-nltk fixes the following issues:

  • CVE-2024-39705: Fixed remote code execution through unsafe pickle usage (boo#1227174).
Record
openSUSE-SU-2024:0222-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14103-1 No score

python310-nltk-3.8.1-2.1 on GA media

These are all security issues fixed in the python310-nltk-3.8.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14103-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11469-1 No score

python313-nltk-3.10.1-1.1 on GA media

These are all security issues fixed in the python313-nltk-3.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11469-1
Updated
2026-11-02
OSVPYSEC-2024-167 No score

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Record
PYSEC-2024-167
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nltk
PyPI
 before 3.9
3.9
nltk
Debian:12
 All versions, plus listed versions
3.10.0-13.10.1-13.10.3-13.8-13.8.1-1
Show 4 moreShow less
3.9.1-13.9.1-23.9.2-13.9.3-1
 None known
nltk
Debian:13
 before 3.9.1-1
3.9.1-1
nltk
Debian:14
 before 3.9.1-1
3.9.1-1
nltk
PyPI
 before 3.9, plus listed versions
0.80.90.9.30.9.40.9.5
Show 45 moreShow less
0.9.60.9.70.9.80.9.92.0.12.0.1rc12.0.1rc2-git2.0.1rc32.0.1rc42.0.22.0.32.0.42.0.52.0b42.0b52.0b62.0b72.0b82.0b93.0.03.0.0b13.0.0b23.0.13.0.23.0.33.0.43.0.53.13.23.2.13.2.23.2.33.2.43.2.53.33.43.4.13.4.23.4.33.4.43.4.53.53.5b13.63.6.1
3.9
nltk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.0~b9-0ubuntu42.0~b9-0ubuntu4.1~esm22.0~b9-0ubuntu4.1~esm42.0~b9-0ubuntu4.1~esm52.0~b9-0ubuntu4.1~esm6
 None known
nltk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.0.4-13.0.5-13.1-13.1-1ubuntu0.13.1-1ubuntu0.1+esm13.1-1ubuntu0.1+esm23.1-1ubuntu0.1+esm33.1-1ubuntu0.1+esm4
 None known
nltk
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.2.4-13.2.5-13.2.5-1ubuntu0.13.2.5-1ubuntu0.1+esm13.2.5-1ubuntu0.1+esm23.2.5-1ubuntu0.1+esm33.2.5-1ubuntu0.1+esm4
 None known
nltk
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.4.5-13.4.5-23.4.5-2ubuntu0.1~esm13.4.5-2ubuntu0.1~esm23.4.5-2ubuntu0.1~esm33.4.5-2ubuntu0.1~esm4
 None known
nltk
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.5-13.6.5-13.6.7-13.7-1
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
nltk
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.8.1-1
 None known
python-nltk
SUSE:Package Hub 15 SP6
 before 3.7-bp156.4.3.1
3.7-bp156.4.3.1
python-nltk
openSUSE:Leap 15.6
 before 3.7-bp156.4.3.1
3.7-bp156.4.3.1
python-nltk
SUSE:Package Hub 15 SP5
 before 3.7-bp155.3.3.1
3.7-bp155.3.3.1
python-nltk
openSUSE:Leap 15.5
 before 3.7-bp155.3.3.1
3.7-bp155.3.3.1
python-nltk
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.8.1-2.1
3.8.1-2.1
python-nltk
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 3.10.1-1.1
3.10.1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-39705 is a critical vulnerability (CVSS 9.8) in Nltk, published June 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in nltk 3.9.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 10 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open