Threats tagged 'brew-acronym-cve-2026-78682'

NLTK's pathsec module contains a server-side request forgery (SSRF) vulnerability that allows bypassing hostname validation when an HTTP proxy is configured. The vulnerability affects functions such as pathsec.urlopen, nltk.data.load, and the NLTK downloader, enabling an attacker to fetch internal-only HTTP resources through the proxy. This can lead to loading forged downloader indexes and installing attacker-chosen package content. The issue arises because proxy-handler inheritance disables hostname validation, allowing requests to be redirected to unintended internal targets. A fix is available that blocks proxied fetches unless explicitly opted into, preventing unvalidated egress through proxies.