PT-2026-64418 · Pypi · Nltk
CVSS v4.0
8.5
High
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NLTK (Natural Language Toolkit) versions prior to 3.9.3
Description
The
nltk.collocations module contains an eval injection flaw. When collocations.py is executed directly, the main block passes command-line arguments to the eval() function as suffixes of BigramAssocMeasures without proper sanitization or allowlist validation. This allows an attacker who can control command-line arguments to provide a Python expression that bypasses the intended attribute lookup to execute arbitrary Python code, including operating system commands through the os module.Recommendations
Update NLTK (Natural Language Toolkit) to version 3.9.3 or later.
Exploit
Fix
Eval Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nltk