NLTK EUVD-2026-65226

Exploitation requires that the attacker control either (a) the current working directory at the time one of the two vulnerable NLTK functions is invoked - on Windows this is sufficient by default due to CWD-first binary resolution - or (b) a relative entry in the PATH environment variable on Unix-like systems, such as '.' or a writable relative directory listed before absolute system paths. The vulnerable code paths (dependencygraph.dot2img, AlignedSent._repr_svg_) must actually be called; applications that import NLTK but never invoke these functions are not exposed. CVSS PR:L confirms that at minimum low-privilege local access is required, and unauthenticated remote exploitation is not feasible without a prior foothold. The primary limiting factors are the local attack vector and the requirement for CWD/PATH influence, which rules out most network-based threat actors absent a pre-existing compromise.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) assigns local access with low privilege and no attack complexity, resulting in a score of 8.5 - high impact across confidentiality, integrity, and availability. The local attack vector meaningfully constrains the threat: opportunistic remote exploitation is not feasible without a preceding foothold. However, the low complexity and low privilege requirements mean that once an attacker has write access to the working directory, exploitation is mechanical and reliable. No EPSS score was provided in the intelligence package, and CISA KEV confirmation is absent; no public POC has been identified. The practical risk is elevated in shared development environments, Jupyter notebook servers processing untrusted data, and CI/CD pipelines where NLTK is invoked against inputs from external contributors - contexts where CWD control is plausible for an attacker. The 'Microsoft' tag in the source data likely flags the Windows-specific CWD search-order behavior as an aggravating factor on that platform. Overall, this is a genuine high-priority issue for teams running NLTK in multi-tenant or pipeline contexts, but lower urgency for isolated single-user workstations.

An attacker with write access to the directory from which a Python application invokes NLTK places a malicious executable named 'dot' in that directory. When the application calls dependencygraph.dot2img or AlignedSent._repr_svg_, NLTK attempts to run the dot binary by bare name; the OS resolves it to the attacker's binary and executes it with the privileges of the running NLTK process. This scenario is particularly realistic in Jupyter notebook environments, shared CI/CD runners, or NLP data pipelines where untrusted input files and user-writable directories coexist with NLTK execution.