Threats tagged 'brew-acronym-cve-2026-33236'

The NLTK downloader contains a path traversal vulnerability in its processing of remote XML index files. This flaw allows an attacker controlling a malicious XML index server to supply crafted 'subdir' and 'id' attributes with path traversal sequences, enabling arbitrary directory creation and file overwrite on the victim's file system. Critical system files such as /etc/passwd can be overwritten if exploited. The vulnerability affects NLTK versions from 2.0.0 up to but not including 2.0.0_3. A fix is available in version 2.0.0_3.