PT-2026-20477 · Pypi+2 · Nltk+2

Published 2025-01-01 · Updated 2026-06-03 · CVE-2025-14009

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nltk/nltk (affected versions not specified)

Description A critical issue exists in the NLTK downloader component. The unzip iter function within nltk/downloader.py utilizes zipfile.extractall() without validating file paths or implementing security checks. This allows attackers to create malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability occurs because NLTK trusts all downloaded packages and extracts them without validation. If a malicious package contains Python files, such as init .py, these files are automatically executed upon import, potentially leading to remote code execution and full system compromise, including file system access, network access, and potential persistence.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-04340

CVE-2025-14009

ECHO-A2CB-9FEB-100C

GHSA-7P94-766C-HGJP

OPENSUSE-SU-2026:10226-1

PYSEC-2026-96

USN-8214-1

Affected Products

Linuxmint

Ubuntu

Nltk

References · 30

• 🔥 https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4 · Exploit
• https://ubuntu.com/security/notices/USN-8214-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14009 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10226-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7p94-766c-hgjp · Vendor Advisory
• https://osv.dev/vulnerability/USN-8214-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-96 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-14009 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-14009 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04340 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-14009 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-14009 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14009 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14009 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14009 · Vendor Advisory