Skip to content
OpenAdvisories

Product · nltk

nltk/nltk

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-12261

    Improper Access Control in nltk/nltk

    A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and…

    nltk nltk/nltk nltk nltk Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2026-12259

    Improper Input Validation in nltk/nltk

    In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response …

    nltk nltk/nltk nltk nltk Debian Ubuntu PyPI