CVE-2024-39705

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averagedperceptrontagger and punkt.

References

Affected packages

Git / github.com/nltk/nltk

Affected ranges

Type

GIT

Repo

https://github.com/nltk/nltk

Events

Introduced

Last affected

63a63b1a7793aceceb1efc23bc1fd87e7095f9d5

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.8.1"
        }
    ]
}

Affected versions

2.*

2.0.1rc1

2.0.1rc2

2.0.1rc3

2.0.1rc4

2.0.3

2.0.4

3.*

3.0.0

3.0.0b1

3.0.0b2

3.0.2

3.0.3

3.0.4

3.0.5

3.0a1

3.0a4

3.1

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.3

3.4

3.4.1

3.4.3

3.4.4

3.5

3.5b1

3.6

3.6.1

3.6.2

3.6.3

3.6.4

3.6.5

3.6.6

3.6.7

3.7

3.8

3.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-39705.json"