All vulnerabilities
CVE-2026-12252GHSA-9r6g-266r-89x4PYSEC-2026-2085

NLTK Stanford wrapper classes execute untrusted JAR files without verification

nltk nltkpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Jul 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.9.4Fixed versionGitHub
Published4 Jul 2026Updated 2 Oct 2026CVE List

What fixes it

  • 3.9.4nltk, pipGitHub
  • 3.9.4nltk, PyPIOSVpip install "nltk>=3.9.4"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the java() function, which invokes subprocess.Popen() without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.

Text from CVE List

Affected versions 53

  • nltk, pip< 3.9.4GitHub
  • nltk/nltkaffected: unspecified through latestCVE List
  • nltk, PyPIfrom first release, fixed in 3.9.4OSV
  • nltk, PyPI0.8OSV
  • nltk, PyPI0.9OSV
  • nltk, PyPI0.9.3OSV
  • nltk, PyPI0.9.4OSV
  • nltk, PyPI0.9.5OSV
  • nltk, PyPI0.9.6OSV
  • nltk, PyPI0.9.7OSV
  • nltk, PyPI0.9.8OSV
  • nltk, PyPI0.9.9OSV
  • nltk, PyPI2.0.1OSV
  • nltk, PyPI2.0.1rc1OSV
  • nltk, PyPI2.0.1rc2-gitOSV
  • nltk, PyPI2.0.1rc3OSV
  • nltk, PyPI2.0.1rc4OSV
  • nltk, PyPI2.0.2OSV
  • nltk, PyPI2.0.3OSV
  • nltk, PyPI2.0.4OSV
  • nltk, PyPI2.0.5OSV
  • nltk, PyPI2.0b4OSV
  • nltk, PyPI2.0b5OSV
  • nltk, PyPI2.0b6OSV
  • nltk, PyPI2.0b7OSV
  • nltk, PyPI2.0b8OSV
  • nltk, PyPI2.0b9OSV
  • nltk, PyPI3.0.0OSV
  • nltk, PyPI3.0.0b1OSV
  • nltk, PyPI3.0.0b2OSV
  • nltk, PyPI3.0.1OSV
  • nltk, PyPI3.0.2OSV
  • nltk, PyPI3.0.3OSV
  • nltk, PyPI3.0.4OSV
  • nltk, PyPI3.0.5OSV
  • nltk, PyPI3.1OSV
  • nltk, PyPI3.2OSV
  • nltk, PyPI3.2.1OSV
  • nltk, PyPI3.2.2OSV
  • nltk, PyPI3.2.3OSV
  • nltk, PyPI3.2.4OSV
  • nltk, PyPI3.2.5OSV
  • nltk, PyPI3.3OSV
  • nltk, PyPI3.4OSV
  • nltk, PyPI3.4.1OSV
  • nltk, PyPI3.4.2OSV
  • nltk, PyPI3.4.3OSV
  • nltk, PyPI3.4.4OSV
  • nltk, PyPI3.4.5OSV
  • nltk, PyPI3.5OSV
  • nltk, PyPI3.5b1OSV
  • nltk, PyPI3.6OSV
  • nltk, PyPI3.6.1OSV

References 8