PT-2026-26217 · Nltk+2 · Nltk+2

Leduckhuong · Published 2026-03-18 · Updated 2026-06-03 · CVE-2026-33230

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.3 and prior

Description NLTK (Natural Language Toolkit) contains a reflected cross-site scripting (XSS) issue in the lookup ... route of nltk.app.wordnet app. A crafted lookup <payload> URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without proper escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application. The issue is exploitable because Reference.decode() accepts attacker-controlled base64-encoded pickle data for the URL state, and the decoded word is reflected into HTML without escaping. The vulnerable code is located in nltk/app/wordnet app.py at lines 144, 755, 769, and 796. The API endpoint affected is /lookup <payload>. The vulnerable parameter is word.

Recommendations Versions prior to 3.9.3 should be updated to address this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33230

ECHO-71BE-89BB-7761

GHSA-GFWX-W7GR-FVH7

MGASA-2026-0082

OPENSUSE-SU-2026:10461-1

USN-8302-1

Affected Products

Linuxmint

Nltk

Ubuntu

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33230.json · Exploit
• https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7 · Vendor Advisory
• https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e · Patch
• https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f · Patch
• https://ubuntu.com/security/CVE-2026-0848 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33230 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8302-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0082 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33230 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33230 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10461-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8302-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0082.html · Security Note