CVE-2026-126295

NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths

NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126296

NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params

NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126297

NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances

NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126298

NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form

NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126299

NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring

NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126300

NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126301

NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126302

NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126303

NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126304

NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader

NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-81726

NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-109956

NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-12259

Improper Input Validation in nltk/nltk

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk Nltk/nltk

CVE-2026-63310

nltk: NLTK before 3.9.3 Missing Post-Download Integrity Verification

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-54293

NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-33231

NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-12261

Improper Access Control in nltk/nltk

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk Nltk/nltk

CVE-2026-12372

Server-Side Request Forgery (SSRF) in nltk/nltk

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk Nltk/nltk

CVE-2026-80205

NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-79675

NLTK before 3.10.3 JVM Argument Injection via Per-Call Options

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk