CVE-2026-12261GHSA-ffj6-66c4-86gwPYSEC-2026-3954

NLTK downloader allows cross-package resource and model poisoning

nltk nltkpipLibraries & packages

CVSS

5.3Medium

ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Aug 2026. Not in the KEV catalogCISA via CVE List

Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.10.0Fixed versionGitHub

Published7 Aug 2026Updated 2 Oct 2026CVE List

What fixes it

3.10.0nltk, pipGitHub
3.10.0nltk, PyPIOSVpip install "nltk>=3.10.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-12261 A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaTelegram: CVE Notify, 23 Oct 2026

Description

A vulnerability in nltk.downloader in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

Text from CVE List

Affected versions 53

nltk, pip< 3.10.0GitHub
nltk/nltkaffected: unspecified through latestCVE List
nltk, PyPIfrom first release, fixed in 3.10.0OSV
nltk, PyPI0.8OSV
nltk, PyPI0.9OSV
nltk, PyPI0.9.3OSV
nltk, PyPI0.9.4OSV
nltk, PyPI0.9.5OSV
nltk, PyPI0.9.6OSV
nltk, PyPI0.9.7OSV
nltk, PyPI0.9.8OSV
nltk, PyPI0.9.9OSV
nltk, PyPI2.0.1OSV
nltk, PyPI2.0.1rc1OSV
nltk, PyPI2.0.1rc2-gitOSV
nltk, PyPI2.0.1rc3OSV
nltk, PyPI2.0.1rc4OSV
nltk, PyPI2.0.2OSV
nltk, PyPI2.0.3OSV
nltk, PyPI2.0.4OSV
nltk, PyPI2.0.5OSV
nltk, PyPI2.0b4OSV
nltk, PyPI2.0b5OSV
nltk, PyPI2.0b6OSV
nltk, PyPI2.0b7OSV
nltk, PyPI2.0b8OSV
nltk, PyPI2.0b9OSV
nltk, PyPI3.0.0OSV
nltk, PyPI3.0.0b1OSV
nltk, PyPI3.0.0b2OSV
nltk, PyPI3.0.1OSV
nltk, PyPI3.0.2OSV
nltk, PyPI3.0.3OSV
nltk, PyPI3.0.4OSV
nltk, PyPI3.0.5OSV
nltk, PyPI3.1OSV
nltk, PyPI3.2OSV
nltk, PyPI3.2.1OSV
nltk, PyPI3.2.2OSV
nltk, PyPI3.2.3OSV
nltk, PyPI3.2.4OSV
nltk, PyPI3.2.5OSV
nltk, PyPI3.3OSV
nltk, PyPI3.4OSV
nltk, PyPI3.4.1OSV
nltk, PyPI3.4.2OSV
nltk, PyPI3.4.3OSV
nltk, PyPI3.4.4OSV
nltk, PyPI3.4.5OSV
nltk, PyPI3.5OSV
nltk, PyPI3.5b1OSV
nltk, PyPI3.6OSV
nltk, PyPI3.6.1OSV