[GHSA] GHSA-rhp5-r9x4-f5g2 (critical) — NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

GHSA-rhp5-r9x4-f5g2 Severity: critical CVE: CVE-2026-78683

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

## Summary

The NLTK library's `TransitionParser.parse()` method deserializes model files using `pickle_load()` with the default `restricted=False` parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provi