CVE-2026-0848

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0848", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-01-10T23:59:44.115Z", "datePublished": "2026-03-05T20:48:05.364Z", "dateUpdated": "2026-03-06T16:31:01.105Z"}, "containers": {"cna": {"title": "Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-03-05T20:48:05.364Z"}, "descriptions": [{"lang": "en", "value": "NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM."}], "affected": [{"vendor": "nltk", "product": "nltk/nltk", "versions": [{"version": "unspecified", "status": "affected", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-20 Improper Input Validation", "cweId": "CWE-20"}]}], "source": {"advisory": "08b109bb-ac24-403f-9422-1c246ce60202", "discovery": "EXTERNAL"}}, "adp": [{"references": [{"url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T16:30:57.313646Z", "id": "CVE-2026-0848", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:31:01.105Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0848", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T16:30:57.313646Z"}}}], "references": [{"url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:30:50.393Z"}}], "cna": {"title": "Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading", "source": {"advisory": "08b109bb-ac24-403f-9422-1c246ce60202", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nltk", "product": "nltk/nltk", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202"}], "descriptions": [{"lang": "en", "value": "NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-03-05T20:48:05.364Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0848", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:31:01.105Z", "dateReserved": "2026-01-10T23:59:44.115Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2026-03-05T20:48:05.364Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nltk/nltk", "vendor": "nltk", "versions": [{"lessThanOrEqual": "latest", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*", "matchCriteriaId": "D07FBCBF-3A88-4B1B-AF47-76DF3B7B13B6", "versionEndIncluding": "3.9.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM."}, {"lang": "es", "value": "Las versiones de NLTK &lt;=3.9.2 son vulnerables a ejecuci\u00f3n de c\u00f3digo arbitrario debido a una validaci\u00f3n de entrada inadecuada en el m\u00f3dulo StanfordSegmenter. El m\u00f3dulo carga din\u00e1micamente archivos .jar de Java externos sin verificaci\u00f3n ni sandboxing. Un atacante puede suministrar o reemplazar el archivo JAR, permitiendo la ejecuci\u00f3n de bytecode Java arbitrario en el momento de la importaci\u00f3n. Esta vulnerabilidad puede ser explotada a trav\u00e9s de m\u00e9todos como el envenenamiento de modelos, ataques MitM o el envenenamiento de dependencias, lo que lleva a ejecuci\u00f3n remota de c\u00f3digo. El problema surge de la ejecuci\u00f3n directa del archivo JAR a trav\u00e9s de un subproceso con entrada de classpath no validada, permitiendo que clases maliciosas se ejecuten cuando son cargadas por la JVM."}], "id": "CVE-2026-0848", "lastModified": "2026-06-17T10:11:29.703", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@huntr.dev", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0848", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T16:30:57.313646Z", "version": "2.0.3"}}]}, "published": "2026-03-05T21:16:14.263", "references": [{"source": "security@huntr.dev", "tags": ["Exploit", "Vendor Advisory"], "url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security@huntr.dev", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading", "id": "2444957", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444957"}, "csaw": false, "cvss3": {"cvss3_base_score": "10.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-829", "details": ["A code injection flaw was found in nltk. The StanfordSegmenter module in NLTK (Natural Language Toolkit) is vulnerable to arbitrary code execution due to improper input validation. An attacker can exploit this by supplying or replacing Java Archive (JAR) files, which are dynamically loaded without verification or sandboxing. This allows for the execution of arbitrary Java bytecode at import time, potentially leading to remote code execution through methods such as model poisoning, Man-in-the-Middle (MITM) attacks, or dependency poisoning."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-0848", "package_state": [{"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Not affected", "package_name": "lightspeed-core/lightspeed-stack-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Not affected", "package_name": "openshift-lightspeed/lightspeed-ocp-rag-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Not affected", "package_name": "openshift-lightspeed/lightspeed-service-api-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Not affected", "package_name": "openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-llama-stack-core-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-ta-lmes-job-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-03-05T20:48:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-0848\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-0848\nhttps://github.com/nltk/nltk/pull/3477\nhttps://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202"], "statement": "While this flaw is rated as a critical severity flaw upstream it poses no risk to Red Hat products. The preconditions for the flaw assume a supply chain compromise of a jar file distributed with the NLTK component. Red Hat controls and verifies this supply chain for Red Hat products."}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nltk/nltk", "source": "cna", "vendor": "nltk"}, "product": "nltk/nltk", "vendor": "nltk"}], "analysis": {"en": {"generated_at": "2026-04-21T23:38:04.812945+00:00", "value": {"mitigation_remediation": ["Check the official NLTK releases and apply any patch that validates jar inputs or removes the unsafe subprocess call.", "If an upgrade cannot be performed immediately, limit file system permissions on the directory containing the StanfordSegmenter jars so that only trusted administrators can modify them, preventing unauthorized replacement.", "Deploy monitoring to detect unexpected changes to the jar files or to the JVM classpath used by NLTK, and consider sandboxing or disabling automatic execution of unverified Java code during the module import."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The Natural Language Toolkit version 3.9.2 and earlier are affected. The vulnerability applies to all installations that use the StanfordSegmenter component provided by nltk, irrespective of platform, as long as the jar files reside in the standard location.", "description_and_impact": "NLTK releases up to and including 3.9.2 contain a flaw in the StanfordSegmenter module that allows an attacker to supply or replace the Java .jar file used at import time. The module launches a Java subprocess with an unvalidated classpath, causing any malicious classes in the jar to execute with full privileges in the host JVM. This flaw falls under input validation weaknesses and improper restriction of execution path, facilitating the execution of arbitrary Java bytecode and equivalent remote code execution.", "risk_and_exploitability": "The CVSS score of 10.0 reflects a perfect score for confidentiality, integrity, and availability loss. The EPSS score of less than 1\u202f% indicates a very low current probability of exploitation, yet the vulnerability is severe and not listed in the CISA KEV catalog. Attackers would need to place a malicious jar in the npm-specified directory, which could occur through model poisoning, MITM attacks, or dependency poisoning. Once the vulnerable module is imported, the attacker would obtain full control over the JVM process, enabling arbitrary code execution on the host machine."}}}}, "created": "2026-03-06T15:00:56.022532+00:00", "updated": "2026-04-21T23:45:02.968835+00:00", "vendors": ["nltk", "nltk$PRODUCT$nltk/nltk"]}