Threats Tagged 'brew-gptline-cve-2025-71408'

NLTK versions prior to 3.9.3 contain an eval injection vulnerability in the nltk.collocations module. This flaw allows attackers controlling command-line arguments to execute arbitrary Python code by passing unsanitized input to eval() in the __main__ block of collocations.py. The vulnerability arises because command-line arguments are used as suffixes of BigramAssocMeasures without validation, enabling escape from intended attribute lookups and execution of OS commands via the os module. A patch is available to address this issue.