nltk vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-109956 NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated High 8.3 · Oct 13, 2026
• CVE-2026-81726 NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controHigh 8.3 · Aug 27, 2026
• CVE-2026-81722 nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem().High 8.7 · Aug 27, 2026
• CVE-2026-80206 NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module.High 8.2 · Aug 26, 2026
• CVE-2026-80205 NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-High 8.7 · Aug 26, 2026
• CVE-2026-79676 NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathseHigh 8.2 · Aug 25, 2026
• CVE-2026-79675 NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVCritical 9.3 · Aug 25, 2026
• CVE-2026-79674 NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended dHigh 8.8 · Aug 25, 2026
• CVE-2026-79657 NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific Critical 9.3 · Aug 25, 2026
• CVE-2026-78683 NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transiCritical 9.4 · Aug 24, 2026
• CVE-2026-78682 NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/doHigh 8.7 · Aug 24, 2026
• CVE-2026-78681 NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs.High 8.7 · Aug 24, 2026
• CVE-2026-78680 NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, alHigh 8.5 · Aug 24, 2026
• CVE-2026-70626 NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus High 8.6 · Aug 22, 2026
• CVE-2026-66393 NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by suHigh 8.7 · Aug 22, 2026
• CVE-2026-65915 NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, maHigh 7.1 · Aug 22, 2026
• CVE-2026-63312 NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directHigh 8.7 · Aug 22, 2026
• CVE-2026-62388 NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions.High 8.7 · Aug 22, 2026
• CVE-2026-62385 NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outsideHigh 8.2 · Aug 22, 2026
• CVE-2026-62384 NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus High 8.7 · Aug 22, 2026
• CVE-2026-71513 NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, alHigh 8.7 · Aug 22, 2026
• CVE-2026-72818 The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain braHigh 8.7 · Aug 20, 2026
• CVE-2026-12252 In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StHigh 7.8 · Jul 3, 2026
• CVE-2026-54293 NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language ProceHigh 7.5 · Jun 22, 2026
• CVE-2026-12199 A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in itHigh 7.5 · Jun 17, 2026