Nltk
Monthly
Path traversal in NLTK through version 3.10.3 allows attackers who control caller-supplied file paths to read or write files outside the boundaries enforced by the pathsec sandbox module. The affected APIs - TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter loading - perform raw file I/O directly on caller-provided paths without routing through pathsec enforcement, undermining the intended access control boundary. The CVSS 4.0 score of 8.3 reflects high confidentiality impact; no public exploit code or CISA KEV listing has been identified at time of analysis.
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.
Path traversal via symlink bypass in NLTK corpus readers before 3.10.3 permits disclosure of arbitrary files outside the trusted corpus data root through standard API calls. Affected corpus reader methods - channels(), domains(), and synonyms() - reopen root-derived paths with Python's built-in open() rather than the secure nltk.pathsec.open(), which enforces symlink restrictions. An attacker who can stage symlinked files inside a trusted corpus directory can leverage this gap to read files the NLTK process can access on the host filesystem. No public exploit has been identified at time of analysis, and a vendor-released patch is available in NLTK 3.10.3.
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the per-call `options` parameter of the `java()` helper to inject dangerous JVM flags (such as `-agentpath`, `-javaagent`, or `@argfile`) into invocations of the bundled Stanford NLP wrapper classes, resulting in arbitrary code execution. The flaw stems from missing validation of JVM options before they are handed to the spawned Java process. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library's pathsec sandbox boundary. The LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors accept caller-supplied corpus root paths without enforcing the intended data-root restriction, enabling CWE-73 (External Control of File Name or Path) exploitation wherever applications forward user-controlled input to these constructors. No public exploit or CISA KEV listing has been identified at time of analysis; real-world severity is highly dependent on whether the affected constructors are reachable from an untrusted network path in the deploying application.
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's pickle allowlist and run commands when a crafted model or tokenizer artifact is loaded. The allowlist trusts whole module namespaces rather than specific safe callables, so dangerous in-namespace functions can be invoked via pickle's REDUCE opcode. Reported by VulnCheck; no public exploit identified at time of analysis, though the root cause and gadget functions are documented in the advisory.
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.
Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP services and load attacker-controlled downloader indexes when an HTTP proxy is configured. The flaw sits in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index, nltk.downloader.Downloader.download): local hostname validation passes the supplied public URL, but proxy-handler inheritance then replaces NLTK's safe URL handlers so the actual fetch is executed by the proxy against an internally-resolvable destination that is never re-validated. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score is 8.7, reflecting high confidentiality impact under network-accessible, unauthenticated conditions.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.
Arbitrary code execution in the NLTK Python library (nltk/nltk 3.9.3 and earlier) allows an attacker to run untrusted Java code when a victim loads a malicious JAR through five Stanford interface wrappers (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, StanfordNeuralDependencyParser). These classes pass a user-controllable JAR path to an internal java() helper that calls subprocess.Popen() with no SHA256 integrity check, so a substituted or poisoned JAR executes with the user's privileges. This is a regression of CVE-2026-0848, whose SHA256 verification fix was applied only to StanfordSegmenter and never propagated to these five classes; no public exploit is identified at time of analysis, though a huntr bounty report exists.
Arbitrary file disclosure in NLTK 3.9.4 lets remote attackers read any file accessible to the Python process by passing percent-encoded path-traversal sequences (e.g. ..%2f) into nltk.data.load() or nltk.data.find(). The flaw is an incomplete fix for GitHub Issue #3504: the _UNSAFE_NO_PROTOCOL_RE guard only matches literal ../ while url2pathname() decodes the encoded form after the check runs, so the validation is bypassed. No public exploit identified at time of analysis, though it was reported through a huntr.com bounty; it is not listed in CISA KEV and no EPSS score was supplied.
Unauthenticated remote denial of service in NLTK's WordNet Browser HTTP server (nltk.app.wordnet_app) through version 3.9.3 allows any network-reachable attacker to terminate the server process by sending a single GET request to /SHUTDOWN%20THE%20SERVER. The server binds to all interfaces by default and invokes os._exit(0) on receipt, with no public exploit identified at time of analysis but exploitation is trivial given the documented endpoint.
Unsafe path handling in NLTK's filestring() function enables attackers to read arbitrary files on affected iOS and AI/ML systems through improper input validation. An unauthenticated attacker can exploit this over the network by supplying directory traversal or absolute paths to access sensitive data, with particular risk in deployments exposing the function through web APIs. No patch is currently available for this high-severity vulnerability (CVSS 8.6).
Remote code execution in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows unauthenticated attackers to execute arbitrary Java bytecode through the StanfordSegmenter module's unvalidated loading of external JAR files. The vulnerability is exploitable via model poisoning, MITM attacks during JAR downloads, or dependency poisoning, with execution occurring automatically at import time. Despite a critical CVSS 10.0 score, EPSS probability of 0.48% (65th percentile) suggests low observed exploitation activity. No CISA KEV listing indicates no confirmed widespread active exploitation, though the vulnerability is publicly documented on huntr.com with technical details available.
Path traversal in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows remote unauthenticated attackers to read arbitrary files from the server hosting NLP applications. Multiple CorpusReader classes (WordListCorpusReader, TaggedCorpusReader, BracketParseCorpusReader) fail to sanitize file paths, enabling directory traversal to access sensitive files including SSH keys, API tokens, and system configurations. This poses critical risk in machine learning APIs, chatbots, and NLP pipelines that process user-controlled file inputs. EPSS score of 0.25% (48th percentile) suggests low widespread exploitation probability despite public disclosure via huntr.com bounty, though the unauthenticated network vector (AV:N/PR:N) and zero attack complexity make this readily exploitable once targets are identified.
Filesystem containment bypass in NLTK's Downloader component allows local attackers with write access to a shared download directory to overwrite arbitrary files outside the intended install root by planting hardlinks before a download operation. All NLTK versions prior to 3.10.3 are affected via the Downloader.download and Downloader.incr_download methods, which fail to validate link targets during package extraction. No public exploit has been identified at time of analysis; risk is highest in shared multi-user environments such as HPC clusters or build servers where the NLTK data directory is world- or group-writable.
Regular expression denial of service in NLTK's Pl196xCorpusReader allows unauthenticated remote attackers to exhaust CPU resources by supplying malformed TEI corpus data containing many unmatched opening tags. Applications exposing NLTK's words() or tagged_words() public APIs over a network boundary-such as NLP services processing user-supplied corpora-are at risk of near-quadratic runtime growth in the read_block method. No public exploit code or CISA KEV listing has been identified at time of analysis; patch 3.10.3 is available.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
Quadratic CPU exhaustion in NLTK before 3.10.3 allows denial of service via malformed XML corpus files processed by XMLCorpusView._read_xml_fragment(). The method rescans the entire accumulated XML buffer on every 1 KiB block read, creating O(n²) time complexity that scales severely with input size. Applications exposing XML corpus ingestion to untrusted input - such as those using BNCCorpusReader - are at realistic risk; no public exploit has been identified and this is not listed in CISA KEV.
SSRF protection bypass in NLTK affects all versions before 3.10.0, where a fail-open logic error in validate_network_url() allows attackers to reach restricted network resources including cloud metadata endpoints such as 169.254.169.254. The flaw resides in _resolve_hostname(), which silently swallows OSError and ValueError from socket.getaddrinfo() and returns an empty list; the subsequent IP validation loop then iterates zero times, allowing urlopen() to execute the request with no filtering applied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the real-world impact is meaningfully elevated for cloud-deployed applications where metadata API access can expose IAM credentials.
Symlink-based arbitrary file read in NLTK's IPIPANCorpusReader exposes files accessible to the running process on systems where untrusted local users can write to corpus root directories. Affected NLTK versions before 3.10.2 fail to follow symlinks through the nltk.pathsec validation layer when IPIPANCorpusReader methods - channels(), domains(), categories(), or fileids() - resolve filenames, allowing the symlink target to be read instead of the intended corpus file. No public exploit or CISA KEV listing has been identified at time of analysis; real-world risk is bounded by the local attack vector and the requirement for write access to the corpus directory.
Path traversal in NLTK's CrubadanCorpusReader (versions 3.9.4 through 3.10.2) allows an attacker who controls a malicious corpus package to read arbitrary file contents outside the corpus root directory via the lang_freq interface. The vulnerability arises because _load_lang_ngrams bypasses NLTK's pathsec containment by calling the builtin open() instead of the pathsec-validated opener, enabling os.path.join to silently discard the corpus root prefix when an absolute path is supplied as the crubadan_code value. No public exploit exists and no KEV listing is present; a vendor patch is available in 3.10.3.
Server-Side Request Forgery in NLTK 3.9.4 and the develop branch enables network-level probing of RFC 6598 shared-address-space hosts (100.64.0.0/10) by exploiting an incomplete block-list in the `validate_network_url()` guard function. The function correctly rejects private and loopback ranges but omits the shared address space defined by RFC 6598, which Python's `ipaddress` module does not classify as either `is_private` or `is_global`, allowing crafted URLs to pass the filter unchallenged. Impact is confined to confidentiality - internal infrastructure reachable through shared carrier-grade NAT space may be probed - and no code execution is achievable through this path; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model files with adversarial replacements. The root cause is that nltk.downloader extracts archives into shared namespaces (corpora/, taggers/) rather than package-isolated directories, and performs integrity validation only after extraction is complete - a classic TOCTOU-like design flaw. Poisoned resources survive interpreter restarts and propagate silently into ML pipelines, making this particularly dangerous in reproducibility-sensitive or automated NLP workflows. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
NLTK's downloader in version 3.9.4 installs attacker-controlled package bytes by writing and potentially extracting downloaded content before enforcing SHA-256 or MD5 checksum validation. Any user or CI pipeline invoking `nltk.download()` against a compromised mirror, rogue proxy, or network-level MITM is at risk of silently installing malicious corpora or model files. No public exploit identified at time of analysis; active exploitation not confirmed (no CISA KEV listing). The AC:H CVSS metric correctly reflects the non-trivial infrastructure access an attacker must achieve, but the downstream trust propagation - NLP applications consuming poisoned models - amplifies the realistic impact beyond the base score.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data downloader: the _unzip_iter function in nltk/downloader.py calls zipfile.extractall() with no path validation, so a malicious data package can drop attacker-controlled Python files (e.g. __init__.py) that execute automatically on import. Any application that downloads NLTK data from an attacker-influenced source is exposed to full remote code execution. Publicly available exploit code exists (huntr.com bounty), EPSS is modest at 0.57% (68th percentile), and there is no public exploit identified as actively exploited in CISA KEV.
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Path traversal in NLTK through version 3.10.3 allows attackers who control caller-supplied file paths to read or write files outside the boundaries enforced by the pathsec sandbox module. The affected APIs - TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter loading - perform raw file I/O directly on caller-provided paths without routing through pathsec enforcement, undermining the intended access control boundary. The CVSS 4.0 score of 8.3 reflects high confidentiality impact; no public exploit code or CISA KEV listing has been identified at time of analysis.
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.
Path traversal via symlink bypass in NLTK corpus readers before 3.10.3 permits disclosure of arbitrary files outside the trusted corpus data root through standard API calls. Affected corpus reader methods - channels(), domains(), and synonyms() - reopen root-derived paths with Python's built-in open() rather than the secure nltk.pathsec.open(), which enforces symlink restrictions. An attacker who can stage symlinked files inside a trusted corpus directory can leverage this gap to read files the NLTK process can access on the host filesystem. No public exploit has been identified at time of analysis, and a vendor-released patch is available in NLTK 3.10.3.
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the per-call `options` parameter of the `java()` helper to inject dangerous JVM flags (such as `-agentpath`, `-javaagent`, or `@argfile`) into invocations of the bundled Stanford NLP wrapper classes, resulting in arbitrary code execution. The flaw stems from missing validation of JVM options before they are handed to the spawned Java process. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library's pathsec sandbox boundary. The LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors accept caller-supplied corpus root paths without enforcing the intended data-root restriction, enabling CWE-73 (External Control of File Name or Path) exploitation wherever applications forward user-controlled input to these constructors. No public exploit or CISA KEV listing has been identified at time of analysis; real-world severity is highly dependent on whether the affected constructors are reachable from an untrusted network path in the deploying application.
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's pickle allowlist and run commands when a crafted model or tokenizer artifact is loaded. The allowlist trusts whole module namespaces rather than specific safe callables, so dangerous in-namespace functions can be invoked via pickle's REDUCE opcode. Reported by VulnCheck; no public exploit identified at time of analysis, though the root cause and gadget functions are documented in the advisory.
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a victim application loads a malicious transition-parser model file. The TransitionParser.parse() method deserializes model data via pickle with restricted=False, so an attacker-supplied model embedding pickle gadget chains executes with the privileges of the loading process. No CISA KEV listing or public exploit code is identified at time of analysis, though this class of pickle-RCE bug is trivially weaponizable once a malicious model is delivered.
Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP services and load attacker-controlled downloader indexes when an HTTP proxy is configured. The flaw sits in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index, nltk.downloader.Downloader.download): local hostname validation passes the supplied public URL, but proxy-handler inheritance then replaces NLTK's safe URL handlers so the actual fetch is executed by the proxy against an internally-resolvable destination that is never re-validated. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score is 8.7, reflecting high confidentiality impact under network-accessible, unauthenticated conditions.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Symlink escape in NLTK's CorpusReader.open() allows local attackers to read arbitrary files outside the designated corpus root, affecting all versions before 3.9.4. Path boundary validation is performed lexically on the string representation of a path rather than on the resolved filesystem target, so an attacker with write access to the corpus directory can plant a symlink that passes the check yet redirects reads to sensitive files anywhere the host process can access. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.9.4.
Unbounded recursion in NLTK's JSONTaggedDecoder.decode_obj() (nltk/jsontags.py) allows unauthenticated remote attackers to crash the Python process by submitting a deeply nested JSON payload exceeding Python's default recursion limit of 1000. All NLTK releases before 3.9.4 are affected; exploitation depends on whether the calling application exposes JSONTaggedDecoder to externally-supplied JSON input. A public proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.
Path traversal and pickle deserialization protections in NLTK before 3.10.0 are effectively disabled by default - pathsec.py sets ENFORCE=False, causing all security validation to emit warnings rather than raise blocking exceptions. Any application using NLTK to process untrusted file paths or serialized data is exposed unless operators have explicitly overridden this default. No public exploit has been identified at time of analysis, but the attack surface is significant wherever NLTK handles attacker-controlled inputs, particularly given that Python pickle deserialization can enable arbitrary code execution.
Path traversal in NLTK's FramenetCorpusReader and NKJPCorpusReader (all versions before 3.10.0) enables unauthenticated network-reachable attackers to read arbitrary XML files accessible to the application process by supplying crafted selectors or poisoned index state to methods including frame_by_name, doc, lu, and header. The CVSS 4.0 score of 8.2 reflects high confidentiality impact (VC:H) tempered by high attack complexity (AC:H) and a required attack target condition (AT:P), meaning exploitation depends on application code that exposes these specific corpus reader methods to external input. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.
Arbitrary code execution in the NLTK Python library (nltk/nltk 3.9.3 and earlier) allows an attacker to run untrusted Java code when a victim loads a malicious JAR through five Stanford interface wrappers (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, StanfordNeuralDependencyParser). These classes pass a user-controllable JAR path to an internal java() helper that calls subprocess.Popen() with no SHA256 integrity check, so a substituted or poisoned JAR executes with the user's privileges. This is a regression of CVE-2026-0848, whose SHA256 verification fix was applied only to StanfordSegmenter and never propagated to these five classes; no public exploit is identified at time of analysis, though a huntr bounty report exists.
Arbitrary file disclosure in NLTK 3.9.4 lets remote attackers read any file accessible to the Python process by passing percent-encoded path-traversal sequences (e.g. ..%2f) into nltk.data.load() or nltk.data.find(). The flaw is an incomplete fix for GitHub Issue #3504: the _UNSAFE_NO_PROTOCOL_RE guard only matches literal ../ while url2pathname() decodes the encoded form after the check runs, so the validation is bypassed. No public exploit identified at time of analysis, though it was reported through a huntr.com bounty; it is not listed in CISA KEV and no EPSS score was supplied.
Unauthenticated remote denial of service in NLTK's WordNet Browser HTTP server (nltk.app.wordnet_app) through version 3.9.3 allows any network-reachable attacker to terminate the server process by sending a single GET request to /SHUTDOWN%20THE%20SERVER. The server binds to all interfaces by default and invokes os._exit(0) on receipt, with no public exploit identified at time of analysis but exploitation is trivial given the documented endpoint.
Unsafe path handling in NLTK's filestring() function enables attackers to read arbitrary files on affected iOS and AI/ML systems through improper input validation. An unauthenticated attacker can exploit this over the network by supplying directory traversal or absolute paths to access sensitive data, with particular risk in deployments exposing the function through web APIs. No patch is currently available for this high-severity vulnerability (CVSS 8.6).
Remote code execution in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows unauthenticated attackers to execute arbitrary Java bytecode through the StanfordSegmenter module's unvalidated loading of external JAR files. The vulnerability is exploitable via model poisoning, MITM attacks during JAR downloads, or dependency poisoning, with execution occurring automatically at import time. Despite a critical CVSS 10.0 score, EPSS probability of 0.48% (65th percentile) suggests low observed exploitation activity. No CISA KEV listing indicates no confirmed widespread active exploitation, though the vulnerability is publicly documented on huntr.com with technical details available.
Path traversal in NLTK (Natural Language Toolkit) versions ≤3.9.2 allows remote unauthenticated attackers to read arbitrary files from the server hosting NLP applications. Multiple CorpusReader classes (WordListCorpusReader, TaggedCorpusReader, BracketParseCorpusReader) fail to sanitize file paths, enabling directory traversal to access sensitive files including SSH keys, API tokens, and system configurations. This poses critical risk in machine learning APIs, chatbots, and NLP pipelines that process user-controlled file inputs. EPSS score of 0.25% (48th percentile) suggests low widespread exploitation probability despite public disclosure via huntr.com bounty, though the unauthenticated network vector (AV:N/PR:N) and zero attack complexity make this readily exploitable once targets are identified.
Filesystem containment bypass in NLTK's Downloader component allows local attackers with write access to a shared download directory to overwrite arbitrary files outside the intended install root by planting hardlinks before a download operation. All NLTK versions prior to 3.10.3 are affected via the Downloader.download and Downloader.incr_download methods, which fail to validate link targets during package extraction. No public exploit has been identified at time of analysis; risk is highest in shared multi-user environments such as HPC clusters or build servers where the NLTK data directory is world- or group-writable.
Regular expression denial of service in NLTK's Pl196xCorpusReader allows unauthenticated remote attackers to exhaust CPU resources by supplying malformed TEI corpus data containing many unmatched opening tags. Applications exposing NLTK's words() or tagged_words() public APIs over a network boundary-such as NLP services processing user-supplied corpora-are at risk of near-quadratic runtime growth in the read_block method. No public exploit code or CISA KEV listing has been identified at time of analysis; patch 3.10.3 is available.
Uncontrolled recursion in NLTK's FeatStructReader component (all versions before 3.10.3) enables unauthenticated remote attackers to crash any Python application that parses user-supplied feature structures or feature grammars. Attackers submit trivially crafted payloads containing deeply nested brackets, exhausting Python's call stack and raising an unhandled RecursionError that terminates the application process. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; a vendor patch is available in NLTK 3.10.3.
Quadratic CPU exhaustion in NLTK before 3.10.3 allows denial of service via malformed XML corpus files processed by XMLCorpusView._read_xml_fragment(). The method rescans the entire accumulated XML buffer on every 1 KiB block read, creating O(n²) time complexity that scales severely with input size. Applications exposing XML corpus ingestion to untrusted input - such as those using BNCCorpusReader - are at realistic risk; no public exploit has been identified and this is not listed in CISA KEV.
SSRF protection bypass in NLTK affects all versions before 3.10.0, where a fail-open logic error in validate_network_url() allows attackers to reach restricted network resources including cloud metadata endpoints such as 169.254.169.254. The flaw resides in _resolve_hostname(), which silently swallows OSError and ValueError from socket.getaddrinfo() and returns an empty list; the subsequent IP validation loop then iterates zero times, allowing urlopen() to execute the request with no filtering applied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the real-world impact is meaningfully elevated for cloud-deployed applications where metadata API access can expose IAM credentials.
Symlink-based arbitrary file read in NLTK's IPIPANCorpusReader exposes files accessible to the running process on systems where untrusted local users can write to corpus root directories. Affected NLTK versions before 3.10.2 fail to follow symlinks through the nltk.pathsec validation layer when IPIPANCorpusReader methods - channels(), domains(), categories(), or fileids() - resolve filenames, allowing the symlink target to be read instead of the intended corpus file. No public exploit or CISA KEV listing has been identified at time of analysis; real-world risk is bounded by the local attack vector and the requirement for write access to the corpus directory.
Path traversal in NLTK's CrubadanCorpusReader (versions 3.9.4 through 3.10.2) allows an attacker who controls a malicious corpus package to read arbitrary file contents outside the corpus root directory via the lang_freq interface. The vulnerability arises because _load_lang_ngrams bypasses NLTK's pathsec containment by calling the builtin open() instead of the pathsec-validated opener, enabling os.path.join to silently discard the corpus root prefix when an absolute path is supplied as the crubadan_code value. No public exploit exists and no KEV listing is present; a vendor patch is available in 3.10.3.
Server-Side Request Forgery in NLTK 3.9.4 and the develop branch enables network-level probing of RFC 6598 shared-address-space hosts (100.64.0.0/10) by exploiting an incomplete block-list in the `validate_network_url()` guard function. The function correctly rejects private and loopback ranges but omits the shared address space defined by RFC 6598, which Python's `ipaddress` module does not classify as either `is_private` or `is_global`, allowing crafted URLs to pass the filter unchallenged. Impact is confined to confidentiality - internal infrastructure reachable through shared carrier-grade NAT space may be probed - and no code execution is achievable through this path; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model files with adversarial replacements. The root cause is that nltk.downloader extracts archives into shared namespaces (corpora/, taggers/) rather than package-isolated directories, and performs integrity validation only after extraction is complete - a classic TOCTOU-like design flaw. Poisoned resources survive interpreter restarts and propagate silently into ML pipelines, making this particularly dangerous in reproducibility-sensitive or automated NLP workflows. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
NLTK's downloader in version 3.9.4 installs attacker-controlled package bytes by writing and potentially extracting downloaded content before enforcing SHA-256 or MD5 checksum validation. Any user or CI pipeline invoking `nltk.download()` against a compromised mirror, rogue proxy, or network-level MITM is at risk of silently installing malicious corpora or model files. No public exploit identified at time of analysis; active exploitation not confirmed (no CISA KEV listing). The AC:H CVSS metric correctly reflects the non-trivial infrastructure access an attacker must achieve, but the downstream trust propagation - NLP applications consuming poisoned models - amplifies the realistic impact beyond the base score.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data downloader: the _unzip_iter function in nltk/downloader.py calls zipfile.extractall() with no path validation, so a malicious data package can drop attacker-controlled Python files (e.g. __init__.py) that execute automatically on import. Any application that downloads NLTK data from an attacker-influenced source is exposed to full remote code execution. Publicly available exploit code exists (huntr.com bounty), EPSS is modest at 0.57% (68th percentile), and there is no public exploit identified as actively exploited in CISA KEV.
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.