Search for packages
| purl | pkg:pypi/nltk@3.10.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
PYSEC-0000-CVE-2026-62383
Aliases: CVE-2026-62383 GHSA-3hhw-38pf-pxj6 PYSEC-2026-3726 |
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers … |
Vulnerable |
|
PYSEC-2026-3739
Aliases: CVE-2026-81724 GHSA-cw6x-m8jw-qmrh |
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service … |
Vulnerable |
|
PYSEC-2026-3733
Aliases: CVE-2026-78682 GHSA-6ww7-3frv-cqxh |
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is … |
Vulnerable |
|
PYSEC-2026-3736
Aliases: CVE-2026-79674 GHSA-3gq4-3j92-5w49 |
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside … |
Vulnerable |
|
PYSEC-2026-3735
Aliases: CVE-2026-79657 GHSA-x99w-6fgc-pmfw |
NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead … |
Vulnerable |
|
PYSEC-2026-3741
Aliases: CVE-2026-81727 GHSA-f794-5jv7-7672 |
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to … |
Vulnerable |
|
PYSEC-2026-3740
Aliases: CVE-2026-81726 GHSA-8mgp-746c-j5xp |
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations … |
Vulnerable |
|
PYSEC-2026-3737
Aliases: CVE-2026-79676 GHSA-p4rw-rvv2-7xwr |
NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead … |
Vulnerable |
|
PYSEC-2026-3738
Aliases: CVE-2026-81722 GHSA-ww6m-cw3f-q94g |
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper … |
Vulnerable |
|
PYSEC-2026-3751
Aliases: CVE-2026-80206 GHSA-w3v8-gmh9-3wv7 |
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles … |
Vulnerable |
|
PYSEC-2026-3749
Aliases: CVE-2026-79675 GHSA-m4rf-3fr8-xwx3 |
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers … |
Vulnerable |
|
PYSEC-2026-3748
Aliases: CVE-2026-78681 GHSA-97qj-x29f-37w7 |
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers … |
Vulnerable |
|
PYSEC-2026-3752
Aliases: CVE-2026-81725 GHSA-8mpw-7fpc-4gqj |
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU … |
Vulnerable |
|
PYSEC-2026-3789
Aliases: CVE-2026-62384 GHSA-f833-7jw8-xwrv |
NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside … |
Vulnerable |
|
PYSEC-2026-3869
Aliases: CVE-2026-12876 GHSA-ff5c-cp5c-9wjf |
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars `nltk.parse.RecursiveDescentParser` (and `SteppingRecursiveDescentParser`) enumerate parses top-down with no bound … |
Vulnerable |
|
PYSEC-2026-3868
Aliases: CVE-2026-78680 GHSA-6hwm-xvph-95vm |
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary Two NLTK sites executed the Graphviz `dot` program by bare … |
Vulnerable |
|
PYSEC-2026-3790
Aliases: CVE-2026-71514 GHSA-cv22-g7mw-8v73 |
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 … |
Vulnerable Vulnerable |
|
PYSEC-2026-3867
Aliases: CVE-2026-71513 GHSA-5gh2-94qg-qppq |
NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler … |
Vulnerable |
|
PYSEC-2026-3871
Aliases: CVE-2026-81723 GHSA-vp2x-qp44-57v7 |
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()` ## Summary `XMLCorpusView._read_xml_fragment()` reads a corpus file in 1 KiB blocks, appending each block … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-qx2g-xrx7-vfh8
|
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE … |
CVE-2026-72818
|
|
PYSEC-2026-3870
|
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE … |
CVE-2026-72818
GHSA-qx2g-xrx7-vfh8 |