Agent-Kira

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.0 **Description** An issue exists where the `findall()` functions within the `Text` and `TokenSearcher` classes accept user-supplied regular expressions without validation or timeout. This can lead to catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—resulting in indefinite CPU saturation and denial of service for all users of the Python process. **Recommendations** Update NLTK to version 3.10.0 or later. As a temporary mitigation, restrict the use of the `findall()` function in `Text` and `TokenSearcher` when processing untrusted user input.

**Name of the Vulnerable Software and Affected Versions** NLTK versions prior to 3.10.3 **Description** The tgrep module contains a regular expression denial of service (ReDoS) issue. The ` tgrep node action()` function compiles user-supplied regular expressions within `/regex/` pattern nodes and executes them using `re.search` against tree node labels without validation or timeouts. An attacker controlling the tgrep pattern, such as through `tgrep positions()` or `tgrep compile()` exposed to external input, can provide a pattern that triggers catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—leading to indefinite CPU saturation and blocking the Python process. **Recommendations** Update to version 3.10.3 or later. As a temporary mitigation, restrict external input to the `tgrep positions()` and `tgrep compile()` functions.