Vulnerabilities for nltk

No release of nltk is currently known to be free of vulnerabilities.

Details

• GHSA-8mpw-7fpc-4gqj2026-09-08

  NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

  Fixed in: 3.10.3

• GHSA-w3v8-gmh9-3wv72026-09-08

  NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

  Fixed in: 3.10.3

• GHSA-rrv8-h7p8-rx552026-09-08

  NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

  Fixed in: 3.10.0

• GHSA-3gq4-3j92-5w492026-09-08

  NLTK: Corpus Reader Sandbox Bypass

  Fixed in: 3.10.3

• GHSA-p4rw-rvv2-7xwr2026-09-08

  NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

  Fixed in: 3.10.3

• GHSA-x99w-6fgc-pmfw2026-09-08

  NLTK: Allowlisted pickle loaders still permit code execution in current source

  Fixed in: 3.10.3

• GHSA-97qj-x29f-37w72026-09-08

  NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

  Fixed in: 3.10.3

• GHSA-6ww7-3frv-cqxh2026-09-08

  NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

  Fixed in: 3.10.3

• GHSA-rhp5-r9x4-f5g22026-09-08

  NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

  Fixed in: 3.10.0

• GHSA-3hhw-38pf-pxj62026-09-08

  NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

  Fixed in: 3.10.2

• GHSA-f833-7jw8-xwrv2026-09-08

  NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

  Fixed in: 3.10.2

• GHSA-568f-pv23-39p42026-09-08

  NLTK: Stable FrameNet and NKJP readers parse outside-root XML

  Fixed in: 3.10.0

• GHSA-5wp5-5229-5g6q2026-09-08

  NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

  Fixed in: 3.9.3

• GHSA-x5ph-mj9p-rfr82026-09-08

  NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

  Fixed in: 3.10.0

• GHSA-72r2-7mfr-5xr92026-09-08

  NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

  Fixed in: 3.10.0

• GHSA-r6gq-whwq-mvg92026-09-08

  NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

  Fixed in: 3.9.4

• GHSA-p3m8-78j2-g5p32026-09-02

  NLTK: Default ENFORCE=False Disables All pathsec Security Controls

  Fixed in: 3.10.0

• GHSA-3gqm-fcw5-w8392026-09-02

  NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

  Fixed in: 3.10.0

• GHSA-ww6m-cw3f-q94g2026-09-02

  NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

  Fixed in: 3.10.3

• GHSA-f794-5jv7-76722026-09-02

  NLTK: Downloader.download follows hardlinks and overwrites outside-root files

  Fixed in: 3.10.3

• GHSA-8mgp-746c-j5xp2026-09-02

  NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

  Fixed in: 3.10.3

• GHSA-vp2x-qp44-57v72026-09-02

  NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

  Fixed in: 3.10.3

• GHSA-ff5c-cp5c-9wjf2026-09-02

  NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

  Fixed in: 3.10.3

• GHSA-cw6x-m8jw-qmrh2026-09-02

  NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

  Fixed in: 3.10.3

• GHSA-m4rf-3fr8-xwx32026-09-01

  NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

  Fixed in: 3.10.3

• GHSA-6hwm-xvph-95vm2026-09-01

  NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

  Fixed in: 3.10.3

• GHSA-5gh2-94qg-qppq2026-08-22

  NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

  Fixed in: 3.10.3

• GHSA-cv22-g7mw-8v732026-08-22

  NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure

  Fixed in: 3.10.3

• GHSA-qx2g-xrx7-vfh82026-08-21

  NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

  Fixed in: 3.10.1

• GHSA-m42h-3232-vpv32026-08-13

  nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

  Fixed in: 3.10.0

• GHSA-2jhm-w3mp-jcwr2026-08-10

  NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

  Fixed in: 3.10.0

• GHSA-ffj6-66c4-86gw2026-08-07

  NLTK downloader allows cross-package resource and model poisoning

  Fixed in: 3.10.0

• GHSA-qvv7-cg9c-w4x32026-07-31

  Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

  Fixed in: 3.10.0

• GHSA-fg7f-2386-88972026-07-31

  Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

  Fixed in: 3.10.0

• GHSA-6hm5-jgcp-p8382026-07-31

  Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

  Fixed in: 3.10.0

• GHSA-xh95-f55m-82fw2026-07-31

  Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

  Fixed in: 3.10.0

• GHSA-848c-c2cx-j7qx2026-07-25

  NLTK vulnerable to Eval Injection via collocations CLI arguments

  Fixed in: 3.9.3

• GHSA-9r6g-266r-89x42026-07-04

  NLTK Stanford wrapper classes execute untrusted JAR files without verification

  Fixed in: 3.9.4

• GHSA-p4gq-832x-fm9v2026-06-16

  Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read

  Fixed in: 3.10.0

• GHSA-469j-vmhf-r6v72026-03-19

  NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

  Fixed in: 3.9.4

• GHSA-jm6w-m3j8-898g2026-03-19

  Unauthenticated remote shutdown in nltk.app.wordnet_app

  Fixed in: 3.9.4

• GHSA-gfwx-w7gr-fvh72026-03-18

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

  Fixed in: 3.9.4

• GHSA-rf74-v2fm-23pw2026-03-18

  Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

  Fixed in: 3.9.4

• GHSA-h8wq-7xc4-p3qx2026-03-09

  NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

  Fixed in: 3.9.3

• PYSEC-2026-992026-03-05

  NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.

  Fixed in: 3.9.3

• GHSA-68j8-pq59-fqgm2026-03-04

  NLTK has a Path Traversal issue

  Fixed in: 3.9.3

• GHSA-7p94-766c-hgjp2026-02-18

  NLTK has a Zip Slip Vulnerability

  Fixed in: 3.9.3

• GHSA-cgvx-9447-vcch2024-06-28

  ntlk unsafe deserialization vulnerability

  Fixed in: 3.9

• GHSA-rqjh-jp2r-59cj2022-01-06

  NLTK Vulnerable to REDoS

  Fixed in: 3.6.6, 2a50a3edc9d35f57ae42a921c621edc160877f4d

• GHSA-f8m6-h2c7-8h9x2022-01-06

  Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)

  Fixed in: 3.6.6, 1405aad979c6b8080dbbc8e0858f89b2e3690341, 3.6.5

• GHSA-2ww3-fxvq-293j2021-09-29

  NLTK Vulnerable to REDoS

  Fixed in: 3.6.4, 277711ab1dec729e626b27aab6fa35ea5efbd7e6

• GHSA-mr7p-25v2-35wr2019-08-23

  NLTK Vulnerable To Path Traversal

  Fixed in: 3.4.5, f59d7ed8df2e0e957f7f247fe218032abdbe9a10