Description
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` contains a reflected cross-site scripting issue in the `lookup_...` route. A crafted `lookup_<payload>` URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled `word` data is reflected into HTML without escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application. Commit 1c3f799607eeb088cab2491dcf806ae83c29ad8f fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | <= 3.9.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nltk | 3.10.0-1 | — |
| Debian 13 | nltk | No fix yet | — |
| Debian 12 | nltk | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | nltk | No fix yet | — |
| Ubuntu 25.10 | nltk | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | nltk | 3.9.2-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 24.04 LTS | nltk | 3.8.1-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 22.04 LTS | nltk | 3.7-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 20.04 LTS | nltk | 3.4.5-2ubuntu0.1~esm4 | — |
| Ubuntu Pro 18.04 LTS | nltk | 3.2.5-1ubuntu0.1+esm4 | — |
| Ubuntu Pro 16.04 LTS | nltk | 3.1-1ubuntu0.1+esm4 | — |
| Ubuntu Pro 14.04 LTS | nltk | 2.0~b9-0ubuntu4.1~esm6 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-nltk | 3.9.4-1.1 | openSUSE-SU-2026:10461-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.16.0-r3 | — |
| Wolfi rolling | open-webui | 0.8.12-r1 | — |
| Wolfi rolling | py3-nltk +3 | 3.9.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | < 3.9.4 | 3.9.4 | GHSA-gfwx-w7gr-fvh7 |
Advisories 2
- WID-SEC-2026-0895 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 19, 2026
- openSUSE-SU-2026:10461-1 python311-nltk-3.9.4-1.1 on GA media SUSE / openSUSE Security Updates · Mar 30, 2026