NLTK CVE-2026-81727

Exploitation requires that the attacker have local write access to the NLTK shared downloader directory (AV:L/PR:L per CVSS 4.0 vector) - this is the critical prerequisite. The downloader directory must be shared or world/group-writable; private per-user NLTK data directories are not exploitable. The attacker must be able to create a hardlink to the intended target file: on Linux systems with fs.protected_hardlinks=1 (default since kernel 3.6), this is limited to files the attacker already owns, significantly narrowing the target set. On older kernels or systems where this protection is disabled, any file on the same filesystem can be hardlinked. Exploitation is triggered passively when any user (or automated process) runs Downloader.download or Downloader.incr_download - no direct attacker-victim interaction is needed after the hardlink is planted. The attack is limited to files on the same filesystem as the NLTK data directory (hardlinks cannot cross filesystem boundaries). Windows behavior with hardlinks differs from POSIX and the exploitability on Windows is not confirmed from available data.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N yields a score of 6.9, reflecting local access with low-privilege requirements and high integrity and availability impact on the vulnerable system, but no subsequent-system scope change. The local attack vector (AV:L) and low-privilege requirement (PR:L) meaningfully constrain real-world exposure - single-user workstations, per-user virtual environments, and properly isolated containers carry limited risk. Exposure is elevated in shared computing environments where the NLTK data directory is world- or group-writable, enabling a non-privileged attacker to stage the attack passively. Note that modern Linux kernels with fs.protected_hardlinks=1 (default since kernel 3.6) restrict hardlink creation to files owned by the linking user, which limits the attacker's ability to target files outside their own ownership - this is not explicitly addressed in the available advisory text and defenders should verify the effective hardlink protection policy in their environment. No KEV listing, no EPSS data, and no public exploit code have been identified; real-world exploitation is plausible but not confirmed.

An attacker with a local account on a shared HPC cluster creates a hardlink inside the world-writable NLTK data directory (e.g., ~/shared/nltk_data) pointing to a target file on the same filesystem, such as a cron script or application configuration file owned by a higher-privileged service account. When a legitimate user or automated pipeline subsequently runs NLTK's Downloader to fetch a corpus package, the extraction writes package content through the hardlink, silently overwriting the target file with attacker-controlled data. No public exploit code has been identified at time of analysis.