Ntlk
Monthly
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.