CVE-2026-78683: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

The NLTK library’s TransitionParser.parse() method deserializes model files using pickle_load() with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization, but it is never used by production code paths, leaving the vulnerability unpatched.