Nltk Library: 16 Vulnerabilities Including Critical RCE Disclosed in Batch
Nltk library hit by 16 vulnerabilities disclosed Aug 25-27, 2026, including Critical RCE, path traversal, and DoS flaws.
Key findings
- 16 Nltk vulnerabilities disclosed between Aug 25-27, 2026, including Critical RCE and High-severity flaws.
- Flaws include unsafe deserialization, path traversal, SSRF, and denial-of-service vulnerabilities.
- Critical RCE possible via pickle manipulation, JVM option injection, and Graphviz binary path issues.
- Affected versions are Nltk < 3.10.0 and < 3.10.3; patched in 3.10.0 and 3.10.3.
- Users urged to update to Nltk 3.10.3 or later to mitigate risks.
The Natural Language Toolkit (Nltk) Python library is facing scrutiny after a significant batch of 16 vulnerabilities was disclosed between August 25 and August 27, 2026. These flaws, ranging in severity from Low to Critical, expose users to risks including remote code execution, denial of service, and unauthorized file access. The disclosures highlight multiple security weaknesses within the library's handling of file operations, data parsing, and external process execution.
Several vulnerabilities center on insecure file handling and path manipulation. CVE-2026-81727 and CVE-2026-79676, both rated High, involve filesystem containment bypass and path traversal, respectively. These flaws allow attackers with write access to specific directories to overwrite files outside intended boundaries or disclose sensitive information through the use of hardlinks and symlinks. Additionally, CVE-2026-81726, another High-severity path traversal vulnerability, affects model-artifact APIs, enabling attackers to read or write files outside sandbox roots by exploiting raw file operations on user-controlled paths. CVE-2026-81724 (Medium) and CVE-2026-79674 (High) also involve path-related issues, with the former enabling denial of service through uncontrolled recursion with nested feature structures and the latter allowing attackers to read files outside data roots by supplying arbitrary paths to corpus reader constructors.
A critical theme among the disclosed vulnerabilities is the risk of remote code execution (RCE). CVE-2026-79657 (Critical) and CVE-2026-78683 (Critical) stem from unsafe deserialization practices. The former exploits allowlisted pickle loaders that trust entire module namespaces, enabling attackers to execute arbitrary code via malicious pickle payloads. The latter, found in the TransitionParser.parse() method, involves unsafe pickle deserialization that bypasses security restrictions. Further RCE potential exists through CVE-2026-78680 (High), which involves insecure handling of the Graphviz dot binary, allowing arbitrary code execution by manipulating the system's search path. CVE-2026-79675 (Critical) also presents an RCE risk by allowing attackers to inject dangerous JVM flags through the java() function's per-call options parameter, potentially leading to arbitrary code execution when interacting with Stanford wrapper classes.
Denial of Service (DoS) vulnerabilities form another significant group within this batch. CVE-2026-81725 (Low) and CVE-2026-78681 (High) are related to XML parsing. The former involves a regular expression DoS in Pl196xCorpusReader due to malformed TEI blocks with unmatched tags, while the latter exploits XML entity declarations in DTDs, leading to excessive memory consumption. CVE-2026-81722 (High) targets the PorterStemmer, causing O(n^2) algorithmic complexity that can lead to DoS. Additionally, CVE-2026-81723 (Low) describes a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() due to inefficient XML fragment rescanning. CVE-2026-81724 (Medium) also contributes to DoS through uncontrolled recursion. Regular expression denial of service (ReDoS) is also present in CVE-2026-80205 (High) and CVE-2026-80206 (High), affecting Text.findall(), TokenSearcher.findall(), and the tgrep module, respectively, due to unvalidated user-supplied regular expressions.
The batch also includes a Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-78682 (High). This flaw occurs in nltk.pathsec.urlopen when an HTTP proxy is configured. While the hostname is validated locally, proxy handler inheritance bypasses the secure HTTP/HTTPS handling, potentially allowing attackers to make unintended requests on behalf of the server.
According to advisories, Nltk versions prior to 3.10.0 and 3.10.3 are affected by these vulnerabilities. Patches are available in Nltk versions 3.10.0 and 3.10.3. Users are strongly advised to update to the patched versions to mitigate the risks associated with these critical and high-severity flaws.
This extensive disclosure underscores the importance of regularly updating the Nltk library and carefully reviewing its security posture, especially for applications handling sensitive data or executing external processes. The range of vulnerabilities, from file manipulation to remote code execution, highlights the need for developers to be aware of the potential impact on their applications and user data.
The vulnerabilities were disclosed across multiple days, with the earliest on August 25, 2026, and the latest on August 27, 2026. The affected versions and the availability of patches in 3.10.0 and 3.10.3 are consistent across multiple reports.
The batch includes critical vulnerabilities such as unsafe pickle deserialization (CVE-2026-79657, CVE-2026-78683) and RCE via JVM option injection (CVE-2026-79675). High-severity flaws include path traversal (CVE-2026-81727, CVE-2026-79676, CVE-2026-81726), RCE via Graphviz manipulation (CVE-2026-78680), SSRF (CVE-2026-78682), and XML parsing DoS (CVE-2026-78681). Medium and Low severity issues also contribute to the overall risk profile.
Nltk versions prior to 3.10.0 and 3.10.3 are impacted. Patches are available in Nltk 3.10.0 and 3.10.3.
The disclosure spans multiple days, from August 25 to August 27, 2026, indicating a coordinated disclosure event.
Users should prioritize updating to Nltk 3.10.3 or later to address these security concerns.