7.8
Élevée
CVE-2026-12252 In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger,…
Description
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| nltk/nltk | Versions non publiées |
Références
- huntr.com huntr.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de nltk/nltk
Les 12 CVE de nltk/nltk →
CVE-2026-12372
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch
3.7
Faible
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk…
5.3
Moyenne
CVE-2026-12259
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes…
5.3
Moyenne
CVE-2026-12243
NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504
7.5
Élevée