Gptline: NLTK vulnerable to Eval Injection via collocations CLI arguments (CVE-2025-71408)
Affects gptlineSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 3.9.3, 1.0.8_14
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
PyPInltkpkg:pypi/nltkOther threats | Affected
| Fixed in
|
Homebrewgptlinepkg:brew/gptlineOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available for NLTK version 3.9.3 and later that fixes this eval injection vulnerability. Users should upgrade to version 3.9.3 or later to remediate this issue. Until patched, avoid running collocations.py with untrusted command-line arguments. No vendor advisory content contradicts this guidance.
Description
NLTK versions prior to 3.9.3 contain an eval injection vulnerability in the nltk.collocations module. This flaw allows attackers controlling command-line arguments to execute arbitrary Python code by passing unsanitized input to eval() in the __main__ block of collocations.py. The vulnerability arises because command-line arguments are used as suffixes of BigramAssocMeasures without validation, enabling escape from intended attribute lookups and execution of OS commands via the os module. A patch is available to address this issue.
Impact
Successful exploitation allows an attacker with local access to the command line to execute arbitrary Python code with the privileges of the user running the script. This can lead to full system compromise, including execution of OS commands, data theft, or disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system.
Summary
CVE-2025-71408 is an eval injection vulnerability in the Natural Language Toolkit (NLTK) before version 3.9.3. Specifically, when the collocations.py script is run directly, the __main__ block uses eval() on command-line arguments to access attributes of BigramAssocMeasures without any allowlist or sanitization. This allows an attacker with control over CLI arguments to supply a crafted Python expression that escapes the intended attribute lookup and executes arbitrary code, including OS commands via the os module. The vulnerability affects versions prior to 3.9.3 and certain versions of the gptline product as specified. The CVSS 3.1 base score is 7.8, indicating high severity, with local attack vector, low complexity, requiring low privileges and no user interaction, and impacts confidentiality, integrity, and availability. No known exploits in the wild have been reported. A patch is available.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2025-71408 (opens in a new tab)
- github.com/nltk/nltk/pull/3465 (opens in a new tab)
- github.com/nltk/nltk/commit/66f14096d952ec8f04934f515e027534bd4eb0ac (opens in a new tab)
- aydinnyunus.github.io/2026/06/07/command-injection-nltk-collocations-eval (opens in a new tab)
- github.com/nltk/nltk/releases/tag/3.9.3 (opens in a new tab)
- vulncheck.com/advisories/nltk-eval-injection-via-collocations-py-command-line-arguments (opens in a new tab)
- github.com/nltk/nltk (opens in a new tab)
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3657.yaml (opens in a new tab)