Threats tagged 'ghsa-469j-vmhf-r6v7'

NLTK's downloader component suffers from a path traversal vulnerability due to improper validation of XML index attributes. This flaw allows an attacker controlling a remote XML index server to specify malicious paths with traversal sequences, leading to arbitrary directory creation and file overwrite on the victim's file system, including critical system files. The vulnerability affects NLTK versions prior to 3.9.4. A patch is available in version 3.9.4.