CyberRota Analysis
AI-GeneratedNLTK versions prior to 3.10.3 are vulnerable due to improper validation of absolute paths when invoking the Graphviz dot binary, which can lead to arbitrary code execution. This vulnerability allows attackers to exploit the bare-name binary resolution on Windows or Unix-like systems by placing a malicious dot binary in the search path or current working directory. Organizations using affected NLTK versions, particularly those in data science or natural language processing, should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.