Skip to content
Advisories.
Packages

NLTK security advisories

52 advisories · 32 critical or high in 12 months · latest Sep 8

Repository

52 advisories

DateAdvisory
Sep 8NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
CVE-2026-81725Mediumfixed in 3.10.3
Sep 8NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
CVE-2026-80206Highfixed in 3.10.3
Sep 8NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
CVE-2026-80205High7.5fixed in 3.10.0
Sep 8NLTK: Corpus Reader Sandbox Bypass
CVE-2026-79674Highfixed in 3.10.3
Sep 8NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
CVE-2026-79676Highfixed in 3.10.3
Sep 8NLTK: Allowlisted pickle loaders still permit code execution in current source
CVE-2026-79657Criticalfixed in 3.10.3
Sep 8NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
CVE-2026-78681Highfixed in 3.10.3
Sep 8NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
CVE-2026-78682Highfixed in 3.10.3
Sep 8NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
CVE-2026-78683Criticalfixed in 3.10.0
Sep 8NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
CVE-2026-62383Medium5.5fixed in 3.10.2
Sep 8NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
CVE-2026-62384High7.5fixed in 3.10.2
Sep 8NLTK: Stable FrameNet and NKJP readers parse outside-root XML
CVE-2026-62385High5.9fixed in 3.10.0
Sep 8NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
CVE-2026-12259Medium5.3fixed in 3.9.3
Sep 8NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
CVE-2026-63312Highfixed in 3.10.0
Sep 8NLTK: FileSystemPathPointer.open() sandbox check is dead code , arbitrary file read via file:// protocol
CVE-2026-65915Medium6.5fixed in 3.10.0
Sep 8NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
CVE-2026-70626High6.2fixed in 3.9.4
Sep 2NLTK: Default ENFORCE=False Disables All pathsec Security Controls
CVE-2026-62388Highfixed in 3.10.0
Sep 2NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
CVE-2026-63311Mediumfixed in 3.10.0
Sep 2NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
CVE-2026-81722Mediumfixed in 3.10.3
Sep 2NLTK: Downloader.download follows hardlinks and overwrites outside-root files
CVE-2026-81727Medium7.1fixed in 3.10.3
Sep 2NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
CVE-2026-81726High7.0no fix yet
Sep 2NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
CVE-2026-81723Medium3.7fixed in 3.10.3
Sep 2NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars
CVE-2026-12876Mediumfixed in 3.10.3
Sep 2NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
CVE-2026-81724Medium5.3fixed in 3.10.3
Sep 1NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
CVE-2026-79675Critical9.8fixed in 3.10.3
Sep 1NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
CVE-2026-78680High7.8fixed in 3.10.3
Aug 22NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution
CVE-2026-71513High8.8fixed in 3.10.3
Aug 22NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure
CVE-2026-71514Low2.5fixed in 3.10.3
Aug 21NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
CVE-2026-72818High7.5fixed in 3.10.1
Aug 13nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
CVE-2026-12243High7.5fixed in 3.10.0
Aug 9A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.6
CVE-2026-12372Low3.7no fix yet
Aug 7A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after t
CVE-2026-12261Medium6.5fixed in 3.10.0
Jul 31Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
CVE-2026-12075High8.6fixed in 3.10.0
Jul 31Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
CVE-2026-12061High7.5fixed in 3.10.0
Jul 31Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12072High7.5fixed in 3.10.0
Jul 31Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
CVE-2026-12074High7.5fixed in 3.10.0
Jul 25NLTK vulnerable to Eval Injection via collocations CLI arguments
CVE-2025-71408High7.8fixed in 3.9.3
Jul 4In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute t
CVE-2026-12252High7.8fixed in 3.9.4
Jun 16Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
CVE-2026-54293High7.5fixed in 3.10.0
Mar 19NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
CVE-2026-33236High8.1no fix yet
Mar 19Unauthenticated remote shutdown in nltk.app.wordnet_app
CVE-2026-33231High7.5fixed in 3.9.4
Mar 18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk
CVE-2026-33230Medium6.1fixed in 3.9.4
Mar 18Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
CVE-2026-66393Mediumfixed in 3.9.4
Mar 9NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
CVE-2026-0846High8.6fixed in 3.9.3
Mar 5NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbit
CVE-2026-0848Critical10.0fixed in 3.9.3
Mar 4NLTK has a Path Traversal issue
CVE-2026-0847High8.6no fix yet
Feb 18NLTK has a Zip Slip Vulnerability
CVE-2025-14009Critical10.0fixed in 3.9.3
Jun 282024ntlk unsafe deserialization vulnerability
CVE-2024-39705High7.5fixed in 3.9
Jan 62022NLTK Vulnerable to REDoS
CVE-2021-3842High7.5fixed in 3.6.6
Jan 62022Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)
CVE-2021-43854High7.5fixed in 3.6.6
Sep 292021NLTK Vulnerable to REDoS
CVE-2021-3828High7.5fixed in 3.6.4
Aug 232019NLTK Vulnerable To Path Traversal
CVE-2019-14751High7.5fixed in 3.4.5
About NLTK

The natural language toolkit for Python.

Packages watched: nltk (PyPI).

nltk/nltk

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.