{"id":"CVE-2024-39705","aliases":["GHSA-cgvx-9447-vcch","PYSEC-2024-167"],"title":"ntlk unsafe deserialization vulnerability","summary":"ntlk unsafe deserialization vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"nltk","product":"nltk","ecosystem":"pip","affected":["nltk < 3.9"],"patched":["nltk 3.9"],"published":"2024-06-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:15.193241968Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cgvx-9447-vcch","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39705"},{"url":"https://github.com/nltk/nltk/issues/2522"},{"url":"https://github.com/nltk/nltk/issues/3266"},{"url":"https://github.com/nltk/nltk/commit/441aecb7d33014bd08672232c6c8bb69c2ceaba2"},{"url":"https://github.com/nltk/nltk"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2024-167.yaml"},{"url":"https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706"}],"tags":["osv","pip"],"epss":0.01346,"epssPercentile":0.70193,"ingestedAt":"2026-09-12T03:13:01.687Z","slug":"CVE-2024-39705","body":"## Overview\n\nNLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.\n\n## Affected packages\n\n- `nltk < 3.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nltk 3.9`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}