CVE-2026-12252

Name of the Vulnerable Software and Affected Versions nltk versions prior to 3.9.4

Description Five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) allow the execution of untrusted JAR code. These classes accept user-controllable JAR paths and execute them through the java() function, which uses subprocess.Popen() without performing integrity verification. This allows for arbitrary code execution when loading untrusted JAR files.

Recommendations Update to a version later than 3.9.3. As a temporary mitigation, avoid providing user-controllable paths to the java() function within the affected Stanford interface classes.