PT-2026-23514 · Unknown+2 · Stanfordsegmenter+2

Published 2026-03-05 · Updated 2026-05-25 · CVE-2026-0848

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.2 and earlier

Description The software contains a flaw due to improper input validation in the StanfordSegmenter module, potentially leading to arbitrary code execution. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode when the module is imported. This can be exploited through model poisoning, man-in-the-middle attacks, or dependency poisoning. The issue stems from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the Java Virtual Machine (JVM).

Recommendations Versions prior to 3.9.2 should be updated.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-0848

PYSEC-2026-99

USN-8302-1

Affected Products

Java Virtual Machine

Nltk

Stanfordsegmenter

References · 20

• 🔥 https://huntr.com/bounties/08b109bb-ac24-403f-9422-1c246ce60202 · Exploit
• https://ubuntu.com/security/CVE-2026-0846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33231 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8302-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0848 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0848 · Security Note
• https://ubuntu.com/security/CVE-2026-33230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0847 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-99 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0848 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8302-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-0848 · Security Note
• https://ubuntu.com/security/CVE-2026-33236 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-0848 · Vendor Advisory