NLTK CVE-2026-12261

The attack requires the victim to invoke nltk.downloader (e.g., via nltk.download()) to fetch at least one package - providing the UI:R interaction. The attacker must control or intercept the package source queried by the downloader, which requires either: (1) a compromised NLTK data mirror or repository, (2) a MitM attack on the download channel if it uses an unencrypted or unauthenticated transport, or (3) a malicious package accepted into the official NLTK data distribution. The NLTK data directory must be shared across packages (i.e., multiple packages write to the same corpora/ or taggers/ root) - this is the default configuration, not a special deployment. Exploitation is limited by AC:H: the attacker cannot passively exploit any NLTK installation; they must actively control what the victim downloads. No special privilege is required on the victim system (PR:N). Authentication requirements for the download endpoint are not confirmed from available data.

The CVSS 3.0 base score of 5.3 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N accurately reflects a real-world threat that is meaningful but not trivially mass-exploitable. AC:H is the critical limiting factor: the attacker must control or inject into the package source the victim queries - whether via a compromised NLTK mirror, a dependency confusion attack, a MitM on an unencrypted download channel, or a malicious package submitted to and accepted by an official NLTK data repository. UI:R requires the victim to explicitly invoke the downloader. The I:H rating is well-justified: once resources are poisoned, every NLTK API call that loads that resource silently uses the attacker-controlled version. The absence of EPSS data and KEV listing indicates no confirmed widespread exploitation. However, the risk is disproportionately high in automated pipelines, CI/CD environments that call nltk.download(), and ML reproducibility contexts where model integrity is a security assumption. The tag 'Authentication Bypass' from huntr.com likely refers to circumventing the implicit trust model of the package namespace, not a credential bypass. No EPSS score was provided in the input data; real-world priority should be assessed by how exposed the environment's NLTK data path is to external or multi-tenant package sources.

An attacker positions a malicious package - either by submitting it to an NLTK data repository, performing a MitM on an HTTP download channel, or exploiting a dependency confusion scenario - such that when a data scientist or automated pipeline calls nltk.download('some-package'), the malicious archive is fetched. The archive contains files path-crafted to overwrite a trusted resource (e.g., a POS tagger model file in taggers/) with an adversarial version. Because extraction precedes integrity validation, the poisoned model is immediately active; the victim's ML application then loads and uses the attacker-controlled model on every subsequent run, across restarts, with no visible error.