CVE-2024-39705

Name of the Vulnerable Software and Affected Versions NLTK versions 3.8.1 and earlier

Description The issue is related to the nltk.download() function in the NLTK library, which can lead to remote code execution when untrusted packages containing pickled Python code are downloaded. This particularly affects the averaged perceptron tagger and punkt packages. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For NLTK versions 3.8.1 and earlier, as a temporary workaround, consider disabling the integrated data package download functionality until a patch is available. Restrict access to untrusted packages to minimize the risk of exploitation. Avoid using the nltk.download() function for packages that may contain pickled Python code until the issue is resolved.