CVE-2026-63310: NLTK before 3.9.3 Missing Post-Download Integrity Verification
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.
Affected Software
Event History
Frequently Asked Questions
Which NLTK installations are affected?
NLTK versions before 3.9.3 are affected when they download packages through the downloader module. The issue applies to package downloads that are subsequently extracted without post-download integrity verification.
What does an attacker need to exploit this?
An attacker must be able to interfere with the package download path, such as through a man-in-the-middle attack or DNS poisoning. Exploitation also requires a user or process to download and extract the attacker-influenced package content.
Is user interaction required?
Yes. The supplied CVSS vector indicates user interaction is required, and the described attack relies on a package download being performed before the malicious contents are extracted.
What is the remediation?
Upgrade NLTK to version 3.9.3 or later. This version boundary is the only remediation information provided.