VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Mar 20, 2026· Updated Mar 24, 2026

nltk Vulnerable to Cross-site Scripting

CVE-2026-33230

Description

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnet_app contains a reflected cross-site scripting issue in the lookup_... route. A crafted lookup_<payload> URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application. Commit 1c3f799607eeb088cab2491dcf806ae83c29ad8f fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nltkPyPI
< 3.9.43.9.4

Affected products

1

Patches

2
40d0bc1d484a

Merge commit from fork

https://github.com/nltk/nltkalvationsMar 18, 2026via ghsa
commit
1 file changed · +3 −1
  • nltk/app/wordnet_app.py+3 −1 modified
    @@ -793,7 +793,9 @@ def page_from_reference(href):
                 except KeyError:
                     pass
     if not body:
-        body = "The word or words '%s' were not found in the dictionary." % word
+        body = "The word or words '%s' were not found in the dictionary." % html.escape(
+            word
+        )
     return body, word
1c3f799607ee

Fix XSS in wordnet_app lookup route

https://github.com/nltk/nltknatgillinMar 18, 2026via ghsa
commit
1 file changed · +3 −1
  • nltk/app/wordnet_app.py+3 −1 modified
    @@ -793,7 +793,9 @@ def page_from_reference(href):
                 except KeyError:
                     pass
     if not body:
-        body = "The word or words '%s' were not found in the dictionary." % word
+        body = "The word or words '%s' were not found in the dictionary." % html.escape(
+            word
+        )
     return body, word

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.