CVE-2025-14009 is a critical code injection vulnerability in the nltk/nltk library's downloader component. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks, trusting all downloaded packages implicitly. Attackers can craft malicious zip archives containing Python files that execute arbitrary code when extracted and imported by NLTK. This vulnerability enables remote code execution leading to full system compromise, including unauthorized file system and network access. The vulnerability affects all versions of nltk/nltk. Red Hat advisories acknowledge the CVE but do not provide a direct patch for nltk, indicating patch status is not yet confirmed.

Successful exploitation allows an attacker to execute arbitrary code on the affected system without any privileges or user interaction, resulting in full system compromise. This includes unauthorized access to the file system, network, and potential persistence on the host. The vulnerability has a CVSS v3.0 score of 10.0 (critical), reflecting its high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat advisories reference this CVE but do not indicate an official fix for nltk. Until a patch is available, users should avoid downloading and extracting untrusted packages with the NLTK downloader. Consider manual validation of downloaded content or restricting network access for environments using NLTK downloader. Monitor official vendor advisories for updates and apply patches promptly once released.