SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-12259

MEDIUM · CVSS 5.3 EPSS 0.10%

Source: NVD + CISA KEV + EPSS · Published 2026-08-03 · Last synced 2026-09-02

CyberRota Analysis

AI-Generated

The vulnerability in nltk version 3.9.4 arises from the `Downloader._download_package()` function, which writes package bytes to disk without validating their integrity via SHA-256 or MD5 checksums. This flaw allows attackers to manipulate the package content through compromised sources, potentially leading to the installation of malicious models or corpora by unsuspecting users. Organizations using nltk for natural language processing should prioritize addressing this vulnerability to mitigate the risk of introducing compromised data into their applications.

CVE
CVE-2026-12259
Severity
MEDIUM
CVSS
5.3
EPSS
0.10%

Original NVD Description

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.