Threats tagged 'ghsa-pv39-qrfq-g8gc'

CVE-2026-12259 is a medium severity vulnerability in nltk version 3.9.4 where the downloader component may write and extract package data before verifying integrity checks such as SHA-256 or MD5. This flaw allows an attacker who can manipulate the package source (e.g., via a compromised mirror or malicious proxy) to substitute malicious package content. As a result, downstream users or applications may trust and use attacker-controlled corpus or model data.