Critical RCE in Python NLTK through 3.9.4 - CVE-2026-78683

XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.

Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP services and load attacker-controlled downloader indexes when an HTTP proxy is configured. The flaw sits in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index, nltk.downloader.Downloader.download): local hostname validation passes the supplied public URL, but proxy-handler inheritance then replaces NLTK's safe URL handlers so the actual fetch is executed by the proxy against an internally-resolvable destination that is never re-validated. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score is 8.7, reflecting high confidentiality impact under network-accessible, unauthenticated conditions.

Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.