CVE-2026-12259

Name of the Vulnerable Software and Affected Versions nltk version 3.9.4

Description The nltk.downloader.Downloader. download package() function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url via a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. Consequently, malicious corpus or model content may be trusted by downstream users or applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.