Nltk Nltk
Monthly
Server-Side Request Forgery in NLTK 3.9.4 and the develop branch enables network-level probing of RFC 6598 shared-address-space hosts (100.64.0.0/10) by exploiting an incomplete block-list in the `validate_network_url()` guard function. The function correctly rejects private and loopback ranges but omits the shared address space defined by RFC 6598, which Python's `ipaddress` module does not classify as either `is_private` or `is_global`, allowing crafted URLs to pass the filter unchallenged. Impact is confined to confidentiality - internal infrastructure reachable through shared carrier-grade NAT space may be probed - and no code execution is achievable through this path; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model files with adversarial replacements. The root cause is that nltk.downloader extracts archives into shared namespaces (corpora/, taggers/) rather than package-isolated directories, and performs integrity validation only after extraction is complete - a classic TOCTOU-like design flaw. Poisoned resources survive interpreter restarts and propagate silently into ML pipelines, making this particularly dangerous in reproducibility-sensitive or automated NLP workflows. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
NLTK's downloader in version 3.9.4 installs attacker-controlled package bytes by writing and potentially extracting downloaded content before enforcing SHA-256 or MD5 checksum validation. Any user or CI pipeline invoking `nltk.download()` against a compromised mirror, rogue proxy, or network-level MITM is at risk of silently installing malicious corpora or model files. No public exploit identified at time of analysis; active exploitation not confirmed (no CISA KEV listing). The AC:H CVSS metric correctly reflects the non-trivial infrastructure access an attacker must achieve, but the downstream trust propagation - NLP applications consuming poisoned models - amplifies the realistic impact beyond the base score.
Arbitrary code execution in the NLTK Python library (nltk/nltk 3.9.3 and earlier) allows an attacker to run untrusted Java code when a victim loads a malicious JAR through five Stanford interface wrappers (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, StanfordNeuralDependencyParser). These classes pass a user-controllable JAR path to an internal java() helper that calls subprocess.Popen() with no SHA256 integrity check, so a substituted or poisoned JAR executes with the user's privileges. This is a regression of CVE-2026-0848, whose SHA256 verification fix was applied only to StanfordSegmenter and never propagated to these five classes; no public exploit is identified at time of analysis, though a huntr bounty report exists.
Arbitrary file disclosure in NLTK 3.9.4 lets remote attackers read any file accessible to the Python process by passing percent-encoded path-traversal sequences (e.g. ..%2f) into nltk.data.load() or nltk.data.find(). The flaw is an incomplete fix for GitHub Issue #3504: the _UNSAFE_NO_PROTOCOL_RE guard only matches literal ../ while url2pathname() decodes the encoded form after the check runs, so the validation is bypassed. No public exploit identified at time of analysis, though it was reported through a huntr.com bounty; it is not listed in CISA KEV and no EPSS score was supplied.
Unauthenticated remote denial of service in NLTK's WordNet Browser HTTP server (nltk.app.wordnet_app) through version 3.9.3 allows any network-reachable attacker to terminate the server process by sending a single GET request to /SHUTDOWN%20THE%20SERVER. The server binds to all interfaces by default and invokes os._exit(0) on receipt, with no public exploit identified at time of analysis but exploitation is trivial given the documented endpoint.
Server-Side Request Forgery in NLTK 3.9.4 and the develop branch enables network-level probing of RFC 6598 shared-address-space hosts (100.64.0.0/10) by exploiting an incomplete block-list in the `validate_network_url()` guard function. The function correctly rejects private and loopback ranges but omits the shared address space defined by RFC 6598, which Python's `ipaddress` module does not classify as either `is_private` or `is_global`, allowing crafted URLs to pass the filter unchallenged. Impact is confined to confidentiality - internal infrastructure reachable through shared carrier-grade NAT space may be probed - and no code execution is achievable through this path; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-package resource and model poisoning in NLTK's downloader (versions <= 3.9.4) allows an attacker who can influence what packages a user downloads to silently overwrite trusted corpora and model files with adversarial replacements. The root cause is that nltk.downloader extracts archives into shared namespaces (corpora/, taggers/) rather than package-isolated directories, and performs integrity validation only after extraction is complete - a classic TOCTOU-like design flaw. Poisoned resources survive interpreter restarts and propagate silently into ML pipelines, making this particularly dangerous in reproducibility-sensitive or automated NLP workflows. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
NLTK's downloader in version 3.9.4 installs attacker-controlled package bytes by writing and potentially extracting downloaded content before enforcing SHA-256 or MD5 checksum validation. Any user or CI pipeline invoking `nltk.download()` against a compromised mirror, rogue proxy, or network-level MITM is at risk of silently installing malicious corpora or model files. No public exploit identified at time of analysis; active exploitation not confirmed (no CISA KEV listing). The AC:H CVSS metric correctly reflects the non-trivial infrastructure access an attacker must achieve, but the downstream trust propagation - NLP applications consuming poisoned models - amplifies the realistic impact beyond the base score.
Arbitrary code execution in the NLTK Python library (nltk/nltk 3.9.3 and earlier) allows an attacker to run untrusted Java code when a victim loads a malicious JAR through five Stanford interface wrappers (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, StanfordNeuralDependencyParser). These classes pass a user-controllable JAR path to an internal java() helper that calls subprocess.Popen() with no SHA256 integrity check, so a substituted or poisoned JAR executes with the user's privileges. This is a regression of CVE-2026-0848, whose SHA256 verification fix was applied only to StanfordSegmenter and never propagated to these five classes; no public exploit is identified at time of analysis, though a huntr bounty report exists.
Arbitrary file disclosure in NLTK 3.9.4 lets remote attackers read any file accessible to the Python process by passing percent-encoded path-traversal sequences (e.g. ..%2f) into nltk.data.load() or nltk.data.find(). The flaw is an incomplete fix for GitHub Issue #3504: the _UNSAFE_NO_PROTOCOL_RE guard only matches literal ../ while url2pathname() decodes the encoded form after the check runs, so the validation is bypassed. No public exploit identified at time of analysis, though it was reported through a huntr.com bounty; it is not listed in CISA KEV and no EPSS score was supplied.
Unauthenticated remote denial of service in NLTK's WordNet Browser HTTP server (nltk.app.wordnet_app) through version 3.9.3 allows any network-reachable attacker to terminate the server process by sending a single GET request to /SHUTDOWN%20THE%20SERVER. The server binds to all interfaces by default and invokes os._exit(0) on receipt, with no public exploit identified at time of analysis but exploitation is trivial given the documented endpoint.