Recent security analysis has identified multiple high-severity vulnerabilities affecting the Natural Language Toolkit library, posing significant risks of arbitrary code execution across deployments. The flaws stem from inadequate input validation and unvalidated binary resolution pathways within specific functional modules. With CVSS scores reaching up to 8.5, these security deficiencies allow local or contextual actors to compromise host systems. Immediate remediation is strongly advised to prevent complete system compromise.
CVE-2026-78680: This vulnerability involves an untrusted search path flaw within dependency rendering routines that invoke external binaries. The affected component is the package's execution wrapper for rendering graphical visualizations without absolute path validation. An attacker can plant a malicious executable in a shared working directory or relative path location to intercept execution. This leads to arbitrary local code execution under the privileges of the active application process, carrying a high CVSS severity score of 8.5.[/subscribe_to_unlock_form]
Recent security analysis has identified multiple high-severity vulnerabilities affecting the Natural Language Toolkit library, posing significant risks of arbitrary code execution across deployments. The flaws stem from inadequate input validation and unvalidated binary resolution pathways within specific functional modules. With CVSS scores reaching up to 8.5, these security deficiencies allow local or contextual actors to compromise host systems. Immediate remediation is strongly advised to prevent complete system compromise.
CVE-2026-78680: This vulnerability involves an untrusted search path flaw within dependency rendering routines that invoke external binaries. The affected component is the package's execution wrapper for rendering graphical visualizations without absolute path validation. An attacker can plant a malicious executable in a shared working directory or relative path location to intercept execution. This leads to arbitrary local code execution under the privileges of the active application process, carrying a high CVSS severity score of 8.5.[emaillocker id="1283"]
CVE-2026-79675: This flaw represents an argument injection vulnerability residing in the integration wrapper functions interfacing with Java virtual environments. The affected component is the internal command execution utility that processes per-call configuration options without sufficient sanitization. An adversary capable of influencing configuration parameters can inject malicious command flags or agent arguments. This results in arbitrary code execution within the runtime environment, presenting a severe risk to host integrity and confidentiality.
Protecting software environments against these threats requires prompt patching and strict configuration controls across all development and production pipelines. Continuous monitoring of execution paths and input parameters will further minimize exposure to these severe software flaws.
We recommend you to update nltk to version 3.10.3.
The following reports contain further technical details:
[/emaillocker]