The NLTK tgrep module suffers from a Regular Expression Denial of Service (ReDoS) vulnerability due to unvalidated user-supplied regex patterns compiled without timeout. This allows an attacker to cause catastrophic backtracking, leading to indefinite CPU consumption and denial of service in applications exposing the tgrep API to external input. The vulnerability affects NLTK versions up to 3.10.2 and has been confirmed with proof-of-concept code demonstrating exponential runtime growth. A patch is available to mitigate this issue.
The NLTK PorterStemmer's stem() function has a quadratic-time denial-of-service vulnerability triggered by tokens containing long runs of the letter 'y'. This causes excessive CPU consumption when processing such tokens, impacting availability but not confidentiality or integrity. The issue arises from an iterative function that repeatedly walks backward over runs of 'y's, resulting in O(n^2) complexity. A fix is available to optimize this to linear time.
A denial of service vulnerability exists in the NLTK library's FeatStructReader parser due to uncontrolled recursion when processing deeply nested feature-structure strings. The parser lacks a maximum recursion depth limit, causing Python's RecursionError to be raised and crash applications that parse untrusted input. This affects NLP tools and pipelines using FeatStruct or FeatureGrammar.fromstring(). The issue is not related to memory safety or code execution but results in application crashes. A patch is available to address this issue.
The Pl196xCorpusReader component in the gptline product has a Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-81725) caused by quadratic CPU growth when parsing malformed TEI blocks with many unmatched opening tags. This affects versions from 1.0.8 up to but not including 1.0.8_23. The vulnerability arises from lazy regex patterns that repeatedly rescan attacker-controlled text, leading to excessive CPU consumption and potential parser thread stalling. No official patch is currently available, but a fix involving replacing the regex parser with a linear parser or bounded tokenizer is recommended.
NLTK's downloader component has a filesystem containment bypass vulnerability where it fails to treat pre-existing hardlinks inside the install tree as unsafe. This allows an attacker with write access to the downloader root on the same filesystem to overwrite files outside the intended installation directory by exploiting hardlinks. The issue affects versions 3.9.4 and 3.10.0-rc2 and is fixed in version 3.10.3.
NLTK's pathsec module contains a server-side request forgery (SSRF) vulnerability in proxied environments. The vulnerability arises because when an HTTP proxy is configured, the hostname validation performed by pathsec.urlopen() is bypassed, allowing requests to internal-only services via the proxy. This affects functions like nltk.data.load and nltk.downloader.Downloader methods. The issue is present in NLTK version 3.10.0-rc2 and not reproducible in 3.9.4. A fix has been implemented that blocks proxied fetches unless explicitly opted into, preventing unvalidated proxied requests.
The NLTK library's TransitionParser.parse() method insecurely deserializes model files using pickle without restricting class resolution, allowing remote code execution (RCE) via malicious pickle files. Although NLTK provides a RestrictedUnpickler for safe deserialization, it is not used in production code paths, leaving versions up to 3.9.4 vulnerable. This vulnerability enables attackers to execute arbitrary code with the privileges of the user running the application. The issue is fixed in NLTK version 3.10.0 and later by enforcing restricted unpickling.
NLTK versions from 1.0.8 up to but not including 1.0.8_23 contain a denial-of-service vulnerability due to unsafe XML entity expansion in several XML parsing functions that use Python's xml.etree.ElementTree directly. Crafted XML documents with nested entity declarations can cause exponential memory amplification (billion laughs attack), leading to high memory consumption and potential service disruption. The vulnerability is mitigated by routing XML parsing through a new nltk.xmlsec module that forbids entity declarations, using defusedxml or a fallback expat pre-scan. A patch is available to address this issue.
CVE-2026-79657 is a critical remote code execution vulnerability in the Natural Language Toolkit (NLTK) library's allowlisted pickle loaders. The vulnerability arises because the allowlist trusts entire module namespaces rather than specific safe globals, allowing crafted pickle payloads to invoke dangerous callables during deserialization. This affects functions such as nltk.picklesec.allowlisted_pickle_load, nltk.tokenize.punkt.punkt_pickle_load, and nltk.parse.transitionparser.TransitionParser.parse in versions before 3.10.3. The flaw permits attackers to execute arbitrary commands when loading attacker-controlled tokenizer or model artifacts, defeating the intended safety mechanism. A patch is available that tightens the allowlist to exact (module, qualname) pairs and denies dangerous modules, effectively blocking these exploits.
CVE-2026-79675 is a critical vulnerability in the NLTK Stanford Java wrappers where JVM argument injection can bypass the previous fix for CVE-2026-12841. The vulnerability arises because the per-call java() function accepts unvalidated JVM options, allowing dangerous flags to be passed directly to the JVM. This affects four Stanford wrapper classes that accept user-supplied java_options without validation. Exploitation could allow arbitrary code execution via malicious JVM flags. A patch is available that adds validation to the per-call options path.
NLTK versions up to 3.10.2 contain a vulnerability where the Graphviz 'dot' binary is invoked by its bare name without validating its absolute path. This allows an attacker who can place a malicious 'dot' executable in the current working directory or a writable directory on the PATH to execute arbitrary code. The issue affects the functions nltk.parse.dependencygraph.dot2img and nltk.translate.api.AlignedSent._repr_svg_. The vulnerability has been fixed by ensuring that the validated absolute path returned by nltk.internals.find_binary is used instead of the bare binary name.
The NLTK TweetTokenizer in gptline contains a denial of service vulnerability due to catastrophic regex backtracking in its URL matching regular expression. This flaw can cause exponential processing time when handling crafted inputs with many alternating label separators, potentially stalling services that tokenize untrusted social media text. A fix bounding the label repetition was introduced in version 3.10.1.
A command injection vulnerability (CVE-2024-34062) exists in the tqdm Python package used by icloudpd. The flaw arises because certain non-boolean CLI arguments are unsafely passed to Python's eval function, allowing arbitrary code execution. This affects icloudpd versions from 1.17.3 up to but not including 1.21.0. A fix is available in tqdm version 4.66.3. No workarounds are available.
A vulnerability in h11 versions before 0.15.0 allows malformed HTTP/1.1 chunked-encoding bodies to be accepted due to lenient parsing of trailing line terminators. This discrepancy can lead to HTTP request smuggling when combined with a proxy that parses chunked bodies differently. The issue is fixed in h11 version 0.15.0.
NLTK's WordNet Browser web UI contains a reflected cross-site scripting (XSS) vulnerability in the lookup route. The issue arises because attacker-controlled input is reflected into the HTML response without proper escaping, allowing injection of arbitrary JavaScript. This affects users running the local or self-hosted WordNet Browser HTTP service. Exploitation requires convincing a user to open a crafted URL, leading to script execution within the browser context of the application.
The nltk.app.wordnet_app contains an unauthenticated remote shutdown vulnerability that allows any client able to reach the HTTP server to terminate the WordNet Browser process by sending a specific GET request. This results in a denial of service as the server exits immediately without controlled shutdown. The issue occurs when the server is started in its default mode, listening on all interfaces with no authentication or confirmation required.
The NLTK FramenetCorpusReader.frame() method contains a path traversal vulnerability that allows an attacker to read arbitrary XML files outside the intended corpus root directory. This occurs because the method constructs file paths from user-supplied frame names without proper containment checks and bypasses the nltk.pathsec sandbox enforcement. The vulnerability affects versions prior to 3.10.0 and certain 1.0.8 versions. A proof-of-concept demonstrates that an attacker can read sensitive XML files outside the corpus root despite strict sandbox enforcement. The vulnerability has a CVSS score of 7.5 (high severity) and a patch is available.
A path traversal vulnerability in the Natural Language Toolkit (NLTK) component NKJPCorpusReader allows an attacker to read arbitrary files outside the intended corpus root directory. This occurs because NKJPCorpusReader constructs file paths via unsafe string concatenation and uses the builtin open() function directly, bypassing NLTK's pathsec sandbox protections even when strict enforcement mode (ENFORCE=True) is enabled. The vulnerability was confirmed in NLTK version 3.9.4 and the current development branch. An attacker controlling the fileids argument can exploit this to read sensitive files outside the corpus root.
CVE-2026-12061 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Natural Language Toolkit (NLTK) ReviewsCorpusReader component used by the gptline product. The vulnerability arises from an unbounded greedy regex pattern in the FEATURES regex, which extracts feature annotations from review lines. When processing a long bracket-less line, the regex causes quadratic backtracking, leading to excessive CPU consumption and hanging the processing thread. This can be exploited by an attacker supplying a crafted review line to cause denial of service without requiring authentication or privileges. A patch is available that bounds the regex to prevent the quadratic behavior while preserving correct extraction on legitimate input.
NLTK's pathsec module includes an SSRF filter intended to block access to loopback, private, link-local, and multicast IP ranges. However, this filter can be bypassed via DNS rebinding, where the hostname resolves to a public IP during validation but resolves to an internal or loopback IP at connection time. This bypass defeats the strict ENFORCE mode, allowing unauthorized access to internal services. The vulnerability is identified as CVE-2026-12075 and has a high severity score of 8.6. A patch is available to address this issue.