PT-2026-26300 · Nltk+2 · Nltk+2

Published 2026-03-19 · Updated 2026-06-03 · CVE-2026-33236

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.3 and prior

Description NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. The NLTK downloader does not validate the subdir and id attributes when processing remote XML index files. This allows attackers controlling a remote XML index server to provide malicious values containing path traversal sequences (such as ../). Successful exploitation can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. The key code locations involved are the XML parsing without validation in nltk/downloader.py:253, path construction without checks in nltk/downloader.py:679, unrestricted directory creation in nltk/downloader.py:687, and file writing without protection in nltk/downloader.py:695. An attack chain involves an attacker controlling a remote XML index server, providing a malicious XML file with path traversal sequences, and the victim executing the downloader. This can result in system file overwrites.

Recommendations Versions prior to 3.9.4 are affected.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33236

ECHO-85D4-7FA8-A8C9

GHSA-469J-VMHF-R6V7

USN-8302-1

Affected Products

Linuxmint

Nltk

Ubuntu

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33236.json · Exploit
• https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7 · Vendor Advisory
• https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a · Patch
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-33236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33236 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0848 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-469j-vmhf-r6v7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33230 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33236 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33236 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8302-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0847 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33236 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33236 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33231 · Vendor Advisory