Skip to content
OpenAdvisories
High USN-4106-1 1 CVE

NLTK vulnerability

Published Aug 20, 2019 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during
extraction. A remote attacker could use this vulnerability to write
arbitrary files to the filesystem

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS nltk 3.1-1ubuntu0.1
Ubuntu · 18.04 LTS 18.04:LTS nltk 3.2.5-1ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2019-14751 Public exploit

    NLTK Vulnerable To Path Traversal

    NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

    nltk nltk nltk Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2019-14751