Threats Tagged 'ghsa-848c-c2cx-j7qx'

NLTK versions prior to 3.9.3 contain an eval injection vulnerability in the nltk.collocations module. This flaw allows attackers controlling command-line arguments to execute arbitrary Python code by passing unsanitized input to eval() in the __main__ block of collocations.py. The vulnerability arises because command-line arguments are used as suffixes of BigramAssocMeasures without validation, enabling escape from intended attribute lookups and execution of OS commands via the os module. A patch is available to address this issue.