What is the CVSS score of CVE-2026-12261?

CVE-2026-12261 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-12261?

Yes, a patch is available for CVE-2026-12261. Update the affected software to the latest version immediately.

NLTK CVE-2026-12261

Q: Which versions of NLTK are affected by CVE-2026-12261?

Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model…. A patch is available.

EUVD-2026-54393 MEDIUM

Improper Access Control (CWE-284)

2026-08-07 @huntr_ai

GHSA-ffj6-66c4-86gw

Authentication Bypass Nltk Nltk

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (huntr_ai) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.3 MEDIUM

Network vector justified by remote package download; AC:H because attacker must control the package source; UI:R because user must explicitly invoke the downloader; I:H for full resource overwrite; no confidentiality or availability impact described.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (huntr_ai).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Sep 04, 2026 - 14:52 NVD

5.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 07, 2026 - 07:01 vuln.today

DescriptionNVD

A vulnerability in nltk.downloader in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

AnalysisAI

Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model files with adversarial replacements. The root cause is that nltk.downloader extracts archives into shared namespaces (corpora/, taggers/) rather than package-isolated directories, and performs integrity validation only after extraction is complete - a classic TOCTOU-like design flaw. Poisoned resources survive interpreter restarts and propagate silently into ML pipelines, making this particularly dangerous in reproducibility-sensitive or automated NLP workflows. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV.

Technical ContextAI

NLTK (Natural Language Toolkit) is a Python library for natural language processing that includes a built-in package downloader (nltk.downloader) used to fetch corpora, pre-trained taggers, and other linguistic resources from remote repositories. The downloader writes extracted archive contents into globally shared directories such as corpora/ and taggers/ under the NLTK data path, which is typically a user-wide or system-wide location (e.g., ~/nltk_data or /usr/share/nltk_data). Because all packages share the same flat namespace rather than package-isolated subdirectories, a maliciously crafted package archive can write files that collide with and overwrite files belonging to a different, legitimate package. The integrity check is performed post-extraction, meaning the poisoned files are already live on disk before any validation can reject them. CWE-284 (Improper Access Control) captures the root cause: the downloader fails to enforce namespace boundaries between packages, allowing one package to mutate the trusted resource space of another. The CPE string cpe:2.3:a:nltk:nltk/nltk:*:*:*:*:*:*:*:* confirms all wildcard versions up to and including 3.9.4 are affected.

RemediationAI

No vendor-released patch version has been confirmed in the available data; the fix version is not independently verified from the provided references. Users should monitor the official NLTK GitHub repository and PyPI for a patched release above 3.9.4. In the interim, the most effective compensating control is to use per-project virtual environments with isolated NLTK data paths (set the NLTK_DATA environment variable to a project-specific directory) so that no shared namespace exists across projects or users - this eliminates the cross-package overwrite surface. Additionally, only invoke nltk.download() from pinned, version-locked package lists in controlled environments, and verify downloaded resource file hashes against known-good values before use. Avoid running nltk.download() in automated CI/CD pipelines pointed at default or shared data directories until a patch is available. The trade-off of NLTK_DATA isolation is that each project must maintain its own copy of downloaded corpora, increasing disk usage. The huntr.com disclosure is at https://huntr.com/bounties/8b8c381e-08a8-4e4f-bb46-a320c96a364f.