{
  "entrypoint_kind": "function_call",
  "entrypoint_detail": "nltk.tokenize.punkt.punkt_pickle_load -> nltk.picklesec.AllowlistUnpickler.find_class (allowed_modules=('nltk.tokenize.punkt','nltk.tokenize'))",
  "service_started": false,
  "healthcheck_passed": false,
  "target_path_reached": true,
  "runtime_stack": [
    "python3",
    "nltk==3.10.2 (vulnerable)",
    "nltk==3.10.3 (fixed)"
  ],
  "target_identity": {
    "repository_url": "https://github.com/nltk/nltk",
    "commit_sha": null,
    "target_digest": "2c7ccacb765c5e26b0cb60fb1b57080af522c6924d12a714a243305ba3637412",
    "runtime_digest": "ff9598a8e20518ee0d557745890cc4435b9578489e2dcbc69c4f81fa060caf7c",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "proof_artifacts": [
    "logs/harness_vuln_1.log",
    "logs/harness_vuln_2.log",
    "logs/harness_fixed_1.log",
    "logs/harness_fixed_2.log",
    "repro/marker_vuln_1.txt",
    "repro/marker_vuln_2.txt",
    "repro/payload_vuln1.pickle",
    "repro/payload_vuln2.pickle",
    "repro/payload_fixed1.pickle",
    "repro/payload_fixed2.pickle"
  ],
  "notes": "Protocol-4 pickle GLOBAL 'nltk.tokenize'/'stanford_segmenter.os.system' passes the module-prefix allowlist on 3.10.2 and executes the attacker command via os.system; 3.10.3 rejects the dotted name before resolution. target_digest=sha256 of nltk-3.10.2 wheel; runtime_digest=sha256 of nltk-3.10.3 wheel (negative control)."
}