EUVD-2026-52226
GHSA-5wp5-5229-5g6q
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Network vector with AC:H reflects mandatory MITM or mirror-compromise prerequisite; PR:N as no victim-system privileges are needed; UI:R as user must invoke the downloader; I:H for silent integrity violation; C:N and A:N as no data exposure or disruption occurs.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
2Blast Radius
ecosystem impact- 7 pypi packages depend on nltk (7 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.9.3.
DescriptionCVE.org
In nltk version 3.9.4, the nltk.downloader.Downloader._download_package() function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
AnalysisAI
NLTK's downloader in version 3.9.4 installs attacker-controlled package bytes by writing and potentially extracting downloaded content before enforcing SHA-256 or MD5 checksum validation. Any user or CI pipeline invoking nltk.download() against a compromised mirror, rogue proxy, or network-level MITM is at risk of silently installing malicious corpora or model files. No public exploit identified at time of analysis; active exploitation not confirmed (no CISA KEV listing). The AC:H CVSS metric correctly reflects the non-trivial infrastructure access an attacker must achieve, but the downstream trust propagation - NLP applications consuming poisoned models - amplifies the realistic impact beyond the base score.
Technical ContextAI
NLTK (Natural Language Toolkit) is a foundational Python library for NLP tasks, shipping a built-in Downloader class that fetches corpora, tokenizers, and pre-trained models from configured mirrors over HTTP/HTTPS. The vulnerable function nltk.downloader.Downloader._download_package() violates the 'verify before trust' principle by persisting downloaded bytes to disk and potentially decompressing archives prior to computing and comparing the expected SHA-256 or MD5 digest. CWE-494 (Download of Code Without Integrity Check) precisely describes this root cause: the integrity gate is positioned after the data has already been written rather than acting as a pre-condition to storage. The affected CPE is cpe:2.3:a:nltk:nltk/nltk:*:*:*:*:*:*:*:*, with the description specifically naming version 3.9.4. The wildcard CPE suggests the flaw may span a broader version range, but only 3.9.4 is confirmed in the report.
RemediationAI
No vendor-released patch identified at time of analysis - the huntr.ai report references the flaw but no fixed NLTK release version is cited in the available data. Upstream fix availability via PR or commit is unconfirmed from the provided references. Until a patched release is confirmed, the most effective compensating control is to avoid using NLTK's built-in downloader over untrusted network paths: restrict all nltk.download() calls to HTTPS-only connections to the official NLTK data server and disable custom mirror configurations. In CI/CD pipelines, pre-stage NLTK data as verified artifacts in a controlled internal registry rather than fetching at build time, eliminating the live download vector entirely. Organizations that must use the downloader should manually verify downloaded package hashes against known-good values from the official NLTK data repository before use. Monitor https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633c35a5d and the NLTK GitHub releases page for patch publication.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Remote code execution in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows unauthenticated attackers to execute arb
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
Same weakness CWE-494 – Download of Code Without Integrity Check
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today