Vulnerability · Published Aug 3, 2026 · Assigned by @huntr_ai
CVE-2026-12259Improper Input Validation in nltk/nltk
Medium 5.3
In plain English
A medium-severity security flaw in nltk/nltk from nltk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nltk | no fix listed | DEBIAN-CVE-2026-12259 |
| Debian:13 | nltk | no fix listed | DEBIAN-CVE-2026-12259 |
| Debian:14 | nltk | no fix listed | DEBIAN-CVE-2026-12259 |
| PyPI | nltk | no fix listed | PYSEC-2026-4318 |
| PyPI | nltk | 3.9.3 | GHSA-5wp5-5229-5g6q |
| PyPI | nltk | no fix listed | GHSA-gf32-cmjh-8m9v |
| PyPI | nltk | 3.9.3 | PYSEC-2026-3729 |
| Ubuntu:26.10 | nltk | no fix listed | UBUNTU-CVE-2026-12259 |
Affected products (as reported)
Weakness: CWE-494 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N