NLTK before version 3.9.3 fails to verify the integrity of downloaded packages in its downloader module before extracting them. This lack of verification enables attackers to exploit man-in-the-middle or DNS poisoning techniques to inject malicious content into the packages. The vulnerability is identified as CVE-2026-63310 and is associated with CWE-494 (Download of Code Without Integrity Check). The CVSS v3.1 base score is 7.1, reflecting network attack vector, high impact on integrity and availability, and requiring user interaction with high attack complexity and no privileges required.

An attacker capable of intercepting or redirecting network traffic can inject malicious package contents into the NLTK downloader process. Because the downloader does not verify file integrity before extraction, these malicious contents can be executed or used by the application, potentially leading to code execution or denial of service. The confidentiality impact is low, but integrity and availability impacts are high.

No official patch or fix is currently documented in the provided data. Users should upgrade to NLTK version 3.9.3 or later once available to ensure file integrity verification is performed. Until then, avoid using the downloader module in untrusted or insecure network environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.