CyberRota Analysis
AI-GeneratedThe vulnerability in nltk version 3.9.4 arises from the `Downloader._download_package()` function, which writes package bytes to disk without validating their integrity via SHA-256 or MD5 checksums. This flaw allows attackers to manipulate the package content through compromised sources, potentially leading to the installation of malicious models or corpora by unsuspecting users. Organizations using nltk for natural language processing should prioritize addressing this vulnerability to mitigate the risk of introducing compromised data into their applications.
Original NVD Description
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.