PT-2026-64418

CVE-2025-71408

Published

2026-06-07

Updated

2026-09-30

Description by

CVSS 4.0

8.5

High

MetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NLTK (Natural Language Toolkit) versions prior to 3.9.3

Description The nltk.collocations module contains an eval injection flaw. When collocations.py is executed directly, the main block passes command-line arguments to the eval() function as suffixes of BigramAssocMeasures without proper sanitization or allowlist validation. This allows an attacker who can control command-line arguments to provide a Python expression that bypasses the intended attribute lookup to execute arbitrary Python code, including operating system commands through the os module.

Recommendations Update NLTK (Natural Language Toolkit) to version 3.9.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')

Related identifiers

CVE-2025-71408