Advisory details:
github_osv / GHSA-ffj6-66c4-86gw
| Advisory ID | github_osv/GHSA-ffj6-66c4-86gw |
| Aliases |
CVE-2026-12261
|
| Summary | NLTK downloader allows cross-package resource and model poisoning A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 4.8 |
| Risk | 2.4 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-284 | Improper Access Control |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 5.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-ffj6-66c4-86gw/GHSA-ffj6-66c4-86gw.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/nltk/nltk | ||
| https://github.com/nltk/nltk/commit/7a5740af89feeb739193db766e11e85dfe78339c | ||
| https://github.com/nltk/nltk/pull/3625 | ||
| https://github.com/nltk/nltk/releases/tag/v3.10.0 | ||
| https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3954.yaml | ||
| 8b8c381e-08a8-4e4f-bb46-a320c96a364f | Other | https://huntr.com/bounties/8b8c381e-08a8-4e4f-bb46-a320c96a364f |
| CVE-2026-12261 | https://nvd.nist.gov/vuln/detail/CVE-2026-12261 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.