CVE-2026-12259
In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation.
Published Aug 3, 2026 · updated Oct 15, 2026 · nltk nltk
In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 3, 2026 · NIST NVD
Detected
In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result
Oct 15, 2026 · NIST NVD
Updated
In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result
Affected
- cpe nltk/nltk3.9.4
Sources
- CVE.orgVulnerability recordCVE-2026-12259
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-12259
In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for t
nvd.nist.gov