Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-78682NLTK before 3.10.3 SSRF Protection Bypass via Proxy
High 7.5
In plain English
A high-severity server-side request forgery in nltk from nltk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nltk | no fix listed | DEBIAN-CVE-2026-78682 |
| Debian:13 | nltk | no fix listed | DEBIAN-CVE-2026-78682 |
| Debian:14 | nltk | 3.10.3-1 | DEBIAN-CVE-2026-78682 |
| PyPI | nltk | 3.10.3 | GHSA-6ww7-3frv-cqxh |
| PyPI | nltk | 3.10.3 | PYSEC-2026-3733 |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-6ww7-3frv-cqxh) vendor-advisory
- VulnCheck Advisory: NLTK before 3.10.3 SSRF Protection Bypass via Proxy third-party-advisory