EUVD-2026-54393
GHSA-ffj6-66c4-86gw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network vector justified by remote package download; AC:H because attacker must control the package source; UI:R because user must explicitly invoke the downloader; I:H for full resource overwrite; no confidentiality or availability impact described.
Primary rating from Vendor (huntr_ai).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in nltk.downloader in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.
AnalysisAI
Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model files with adversarial replacements. The root cause is that nltk.downloader extracts archives into shared namespaces (corpora/, taggers/) rather than package-isolated directories, and performs integrity validation only after extraction is complete - a classic TOCTOU-like design flaw. Poisoned resources survive interpreter restarts and propagate silently into ML pipelines, making this particularly dangerous in reproducibility-sensitive or automated NLP workflows. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
Technical ContextAI
NLTK (Natural Language Toolkit) is a Python library for natural language processing that includes a built-in package downloader (nltk.downloader) used to fetch corpora, pre-trained taggers, and other linguistic resources from remote repositories. The downloader writes extracted archive contents into globally shared directories such as corpora/ and taggers/ under the NLTK data path, which is typically a user-wide or system-wide location (e.g., ~/nltk_data or /usr/share/nltk_data). Because all packages share the same flat namespace rather than package-isolated subdirectories, a maliciously crafted package archive can write files that collide with and overwrite files belonging to a different, legitimate package. The integrity check is performed post-extraction, meaning the poisoned files are already live on disk before any validation can reject them. CWE-284 (Improper Access Control) captures the root cause: the downloader fails to enforce namespace boundaries between packages, allowing one package to mutate the trusted resource space of another. The CPE string cpe:2.3:a:nltk:nltk/nltk:*:*:*:*:*:*:*:* confirms all wildcard versions up to and including 3.9.4 are affected.
RemediationAI
No vendor-released patch version has been confirmed in the available data; the fix version is not independently verified from the provided references. Users should monitor the official NLTK GitHub repository and PyPI for a patched release above 3.9.4. In the interim, the most effective compensating control is to use per-project virtual environments with isolated NLTK data paths (set the NLTK_DATA environment variable to a project-specific directory) so that no shared namespace exists across projects or users - this eliminates the cross-package overwrite surface. Additionally, only invoke nltk.download() from pinned, version-locked package lists in controlled environments, and verify downloaded resource file hashes against known-good values before use. Avoid running nltk.download() in automated CI/CD pipelines pointed at default or shared data directories until a patch is available. The trade-off of NLTK_DATA isolation is that each project must maintain its own copy of downloaded corpora, increasing disk usage. The huntr.com disclosure is at https://huntr.com/bounties/8b8c381e-08a8-4e4f-bb46-a320c96a364f.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Remote code execution in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows unauthenticated attackers to execute arb
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today