CVE-2026-78682

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3

Description A server-side request forgery (SSRF) occurs when an HTTP proxy is configured. The nltk.pathsec.urlopen() function (and its callers nltk.data.load() and nltk.downloader.Downloader.index/download()) validates the requested hostname locally; however, proxy-handler inheritance disables the safe HTTP/HTTPS handlers. Consequently, the proxy performs the fetch against a destination that is not re-validated. This allows an attacker to provide a validated public URL that the proxy forwards to an internal loopback-only service, potentially leading to the disclosure of internal HTTP resources, the loading of forged downloader indexes, and the installation of attacker-chosen package content.

Recommendations Update NLTK to version 3.10.3 or later.