Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: nltk 3.10.3 Clear all filters
TI-2026-55174 CVE-2026-79676 · GHSA-p4rw-rvv2-7xwr

NLTK before 3.10.3 Path Traversal via Symlink Bypass

Priority HIGH 69

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00447 Published 2026-08-25 Partial fix · 3.10.3 CWE-22
TI-2026-55173 CVE-2026-79675 · GHSA-m4rf-3fr8-xwx3

NLTK before 3.10.3 JVM Argument Injection via Per-Call Options

Priority HIGH 81

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00775 Published 2026-08-25 Partial fix · 3.10.3 CWE-88
TI-2026-55172 CVE-2026-79674 · GHSA-3gq4-3j92-5w49

NLTK 3.10.2 Path Traversal via corpus-reader constructors

Priority HIGH 77

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00387 Published 2026-08-25 Partial fix · 3.10.3 CWE-73
TI-2026-55155 CVE-2026-79657 · GHSA-x99w-6fgc-pmfw

NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

Priority HIGH 81

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01267 Published 2026-08-25 Partial fix · 3.10.3 CWE-502
TI-2026-54694 CVE-2026-78682 · GHSA-6ww7-3frv-cqxh

NLTK before 3.10.3 SSRF Protection Bypass via Proxy

Priority HIGH 77

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00435 Published 2026-08-25 Partial fix · 3.10.3 CWE-918
TI-2026-54693 CVE-2026-78681 · GHSA-97qj-x29f-37w7

NLTK before 3.10.3 Entity Expansion DoS via ElementTree

Priority MEDIUM 44

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2026-08-25 Fixed in 3.10.3 CWE-776
TI-2026-54692 CVE-2026-78680 · GHSA-6hwm-xvph-95vm

NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

Priority HIGH 72

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a mali…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00177 Published 2026-08-25 Fixed in 3.10.3 CWE-426