NLTK CVE-2026-66393

Exploitation requires that the target application passes externally-supplied or attacker-controlled JSON data to nltk.jsontags.JSONTaggedDecoder - either directly or through a higher-level NLTK API such as those in nltk/data.py. The vulnerability is not triggered by normal NLTK usage that does not involve JSON deserialization of untrusted input. No authentication is required per the CVSS vector (PR:N), and no special configuration beyond NLTK being installed and reachable is needed; Python's default recursion limit of 1000 (sys.getrecursionlimit()) is the triggering threshold - payloads must exceed this depth. Exploitation is limited to denial of service (process crash); there is no evidence of code execution or data exfiltration potential from this specific flaw. Applications that sanitize or depth-limit JSON input before it reaches the decoder are not exploitable.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the accessibility of this flaw - no authentication, no complexity, network-reachable - but the real-world exploitability is conditional on the application directly passing attacker-controlled JSON to JSONTaggedDecoder. The CVSS vector provides no scope change, confirming impact is bounded to the vulnerable process itself. A public proof-of-concept (53 lines including the payload generator) is confirmed in the GHSA advisory, reducing the skill bar to near zero. No EPSS data was provided; given POC availability and a trivially constructable payload, exploitation probability for exposed deployments should be treated as high. No CISA KEV listing exists, indicating no public evidence of widespread active exploitation at this time. The gap between the high theoretical CVSS and the conditional real-world risk is meaningful: applications that do not expose JSONTaggedDecoder to untrusted input are not practically vulnerable despite the score.

An attacker targeting a web service that uses NLTK to deserialize user-supplied JSON (such as a data annotation tool or NLP API) crafts a payload consisting of 1050 levels of nested JSON objects - trivially generated with a one-liner as shown in the published POC. Submitting this payload to the endpoint causes JSONTaggedDecoder.decode_obj() to recurse past Python's default limit of 1000 frames, raising an unhandled RecursionError that terminates the entire Python worker process, resulting in service downtime. Because the POC is publicly available and the payload requires no special knowledge, any attacker with network access to the endpoint can reliably reproduce the crash.