Threats tagged 'brew-acronym-cve-2026-79675'

A JVM argument injection vulnerability exists in the NLTK Stanford wrappers due to incomplete validation of Java options passed per-call via the java() function. The fix for CVE-2026-12841 validated global JVM options set through config_java(), but the per-call options parameter bypasses this validation, allowing dangerous JVM flags to be injected. This affects four Stanford wrapper classes that accept user-supplied java_options and pass them unvalidated to the JVM. An attacker controlling java_options can inject flags that enable arbitrary code execution or remote debugging. The vulnerability is fixed in version 2.0.0_5 by adding validation to the per-call options path.