Critical RCE Vulnerabilities Disclosed in NLTK Toolkit

A mass disclosure reports four CVEs in NLTK versions before 3.10.3, highlighted by CVE-2026-79657 (CVSS 9.8) that permits remote code execution through unsafe pickle deserialization by trusting entire module namespaces; other flaws allow file disclosure and denial-of-service. The issues affect many NLP/ML pipelines and security tools that use NLTK; patches are available in NLTK 3.10.3 and users are urged to upgrade immediately. No active exploitation was observed at the time of the report.