PYSEC-2026-3729
At a glance
- Published
- Updated
- CVE
- CVE-2026-12259, CVE-2026-63310
- Aliases
- GHSA-5wp5-5229-5g6q, GHSA-gf32-cmjh-8m9v, PYSEC-2026-4318
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Description
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.
Affected packages
| Package | Versions |
|---|---|
| PyPI · nltk | introduced 0, fixed 3.9.3 |
References
- https://www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verification ADVISORY
- https://github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q EVIDENCE
- https://github.com/advisories/GHSA-5wp5-5229-5g6q ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |