High severity7.1NVD Advisory· Published Aug 22, 2026

CVE-2026-63310

Description

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nltk/Nltkllm-fuzzy
Range: <3.9.3

Patches

Vulnerability mechanics

References

github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6qnvd
www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verificationnvd

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000