Gptline: NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary (CVE-2026-78680)

Two NLTK components executed the Graphviz 'dot' program by its bare name, causing process creation to resolve the binary via the search path or current working directory on Windows, rather than a validated absolute path. This allows an attacker with write access to the current working directory or a relative PATH entry to execute arbitrary code by placing a malicious 'dot' binary. The affected functions are nltk.parse.dependencygraph.dot2img and nltk.translate.api.AlignedSent._repr_svg_. The vulnerability is addressed by using nltk.internals.find_binary, which refuses CWD-relative matches and returns only trusted absolute paths. The fix prevents execution of attacker-controlled binaries in place of Graphviz's 'dot'.

An attacker who can write a file named 'dot' in the current working directory or a writable directory on the PATH can execute arbitrary code with the privileges of the user running the NLTK code. This can lead to full compromise of the affected environment. The vulnerability is local and requires the attacker to have write access to the filesystem locations that influence binary resolution. The CVSS score is 7.8 (high), reflecting high confidentiality, integrity, and availability impact with low attack complexity and no user interaction required.

A patch is available that fixes this vulnerability by ensuring the absolute validated path to the 'dot' binary is used instead of the bare name. Users should upgrade to NLTK version 3.10.3 or later where this issue is fixed. The fix rejects binaries resolved from the current working directory or relative PATH entries, preventing execution of attacker-controlled binaries. No additional mitigation is required beyond applying the official fix.