Nltk
CVE-2021-3828
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 13 pypi packages depend on nltk (11 direct, 2 indirect)
Ecosystem-wide dependent count for version 3.6.4.
DescriptionNVD
nltk is vulnerable to Inefficient Regular Expression Complexity
AnalysisAI
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified under CWE-1333. nltk is vulnerable to Inefficient Regular Expression Complexity Affected products include: Nltk.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today