TI-2025-12800 Aliases CVE-2025-14009 GHSA-7p94-766c-hgjp

Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

HIGH 82CWE-94Published 2026-02-18 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01036 64th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial nltk (PyPI): 3.9.3Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nltk	nltk/nltk	up to latest	—	No fix listed	CNA
—	nltk (PyPI)	before 3.9.3	3.9.3	Patch available	GHSA-7p94-766c-hgjp

nltk/nltk Vendornltk Affected up to latest Fixed in — No fix listed CNA
nltk (PyPI) Vendor— Affected before 3.9.3 Fixed in 3.9.3 Patch available GHSA-7p94-766c-hgjp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nltk:nltk::::::::	before 3.9.3	Vulnerable	nltk

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:* Versions before 3.9.3 Vulnerable ·nltk

Remediation

Fix · GHSA-7p94-766c-hgjp nltk (PyPI) Fixed in 3.9.3 Advisory →

Red Hat 1 advisory

RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
RHOAI 2.25.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Lightspeed	Affected	No fix yet
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet
Red Hat OpenShift AI 2.25	Fixed	RHSA-2026:10184

Not affected: 1 product

Red Hat OpenShift AI 2.25

Timeline

2026-10-02 Threatist record created from CVE-2025-14009
2026-10-03 Alias added: GHSA-7p94-766c-hgjp

References

Exploit 1

https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-14009

Other 5

TI-2026-00629 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading CVSS 3.0CRITICAL 10.0
TI-2026-55173 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options CVSS 4.0CRITICAL 9.3
TI-2026-55155 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization CVSS 4.0CRITICAL 9.3
TI-2026-56370 nltk PorterStemmer before 3.10.3 Quadratic-time DoS CVSS 4.0HIGH 8.7
TI-2026-55172 NLTK 3.10.2 Path Traversal via corpus-reader constructors CVSS 4.0HIGH 8.8
TI-2026-54694 NLTK before 3.10.3 SSRF Protection Bypass via Proxy CVSS 4.0HIGH 8.7

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences