Threats tagged 'brew-acronym-cve-2026-78680'

NLTK versions prior to 2.0.0_5 contain a vulnerability where the Graphviz 'dot' binary is invoked by bare name without validating its absolute path. This allows an attacker who can place a malicious 'dot' executable in the current working directory or a writable relative PATH entry to have their binary executed instead, leading to arbitrary code execution. The issue affects the functions nltk.parse.dependencygraph.dot2img and nltk.translate.api.AlignedSent._repr_svg_. A fix is available in version 2.0.0_5 that enforces strict path validation before execution.