CVE-2026-12259: Improper Input Validation in nltk/nltk
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage() function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12259?
CVE-2026-12259 has a medium severity rating of 5.3.
How do I fix CVE-2026-12259?
To fix CVE-2026-12259, update to nltk version 3.9.5 or later where the vulnerability has been addressed.
What are the potential risks associated with CVE-2026-12259?
The risk associated with CVE-2026-12259 includes the possibility of an attacker tampering with downloaded package content.
Which versions of nltk are affected by CVE-2026-12259?
CVE-2026-12259 affects nltk version 3.9.4.
Is user interaction required for CVE-2026-12259 to be exploited?
Yes, user interaction is required as the vulnerability involves downloading packages via the nltk downloader.