AVID-2026-R1508

Description

Vulnerability CVE-2024-39705

Details

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Reason for inclusion in AVID: CVE-2024-39705 targets the NLTK library (used in NLP/AI preprocessing). It allows remote code execution when untrusted pickled Python code is used, and when the integrated data package download feature is involved. This directly concerns software used in AI pipelines, representing a security vulnerability in a component that can be part of AI systems' stack, i.e., a software supply-chain issue in AI tooling and dependencies. The evidence (CVE, NVD entry, issue threads) supports both the vulnerability behavior and its relevance to AI workflows.

References

• NVD entry
• https://github.com/nltk/nltk/issues/3266
• https://github.com/nltk/nltk/issues/2522
• https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706

Affected or Relevant Artifacts

• Developer: n/a
• Deployer: n/a
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2024-06-27
• Version: 0.3.3
• AVID Entry