What is the CVSS score of CVE-2026-0848?

CVE-2026-0848 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of NLTK are affected by CVE-2026-0848?

NLTK (Natural Language Toolkit) versions 3.9.2 and earlier contain a critical remote code execution vulnerability in the StanfordSegmenter module that allows unauthenticated attackers to execute…. A patch is available.

How to fix or mitigate CVE-2026-0848?

Within 24 hours: Inventory all systems running NLTK versions ≤3.9.2, particularly those in production NLP pipelines; disable StanfordSegmenter functionality if currently enabled. Within 7 days: Isolate affected systems from direct internet access; enforce network segmentation to prevent external JAR file downloads; implement content security monitoring on JAR file integrity. Within 30 days: Migrate to alternative NLP libraries (spaCy, TextBlob) where feasible; if NLTK upgrade becomes available, test and deploy immediately to all affected systems.

NLTK CVE-2026-0848

CRITICAL

Improper Input Validation (CWE-20)

2026-03-05 security@huntr.dev

Java RCE

Critical

Disputed · 10.0 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 15:12 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 15:07 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 21:16 nvd

CRITICAL 10.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 pypi packages depend on nltk (9 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.9.3.

DescriptionCVE.org

NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.

AnalysisAI

Remote code execution in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows unauthenticated attackers to execute arbitrary Java bytecode through the StanfordSegmenter module's unvalidated loading of external JAR files. The vulnerability is exploitable via model poisoning, MITM attacks during JAR downloads, or dependency poisoning, with execution occurring automatically at import time. Despite a critical CVSS 10.0 score, EPSS probability of 0.48% (65th percentile) suggests low observed exploitation activity. No CISA KEV listing indicates no confirmed widespread active exploitation, though the vulnerability is publicly documented on huntr.com with technical details available.

Technical ContextAI

NLTK (Natural Language Toolkit) is a Python library for natural language processing that integrates with Stanford NLP tools through Java interoperability. The StanfordSegmenter module uses Python's subprocess module to invoke external JAR files containing Stanford's Chinese word segmenter. The vulnerability stems from CWE-20 (Improper Input Validation) where the classpath parameter passed to the JVM is not sanitized or validated. The module loads JAR files without verifying cryptographic signatures, checking file integrity, or implementing sandbox restrictions on the Java execution environment. This creates a code injection vector at the boundary between Python and Java runtime environments, where malicious JAR files containing arbitrary Java classes can be executed with the privileges of the Python process.

RemediationAI

Upgrade NLTK to version 3.9.3 or later when available, monitoring the official NLTK GitHub repository and PyPI for patched releases addressing this vulnerability per the huntr.com advisory at https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202. Until patched versions are released, implement compensating controls: (1) Pin JAR file versions using cryptographic hash verification before loading, checking SHA256 checksums against known-good values from official Stanford NLP releases - this prevents MITM and poisoning attacks but requires manual hash management. (2) Restrict filesystem permissions on JAR file directories to read-only for the application user and limit write access to trusted administrators only - mitigates local file replacement but not supply chain attacks. (3) If feasible, isolate NLTK processing in containerized environments with egress filtering to prevent post-exploitation lateral movement - adds defense-in-depth but doesn't prevent initial compromise. (4) Audit applications to identify if StanfordSegmenter is actually used; if not required, remove or disable the module entirely - zero risk but loses Chinese segmentation functionality.