CVE-2026-12259 in nltk
Summary
by MITRE • 08/03/2026
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in nltk version 3.9.4 represents a critical security flaw in the package download and validation mechanism that undermines the integrity of the entire natural language processing library ecosystem. This issue specifically affects the `nltk.downloader.Downloader._download_package()` function which handles the retrieval and installation of various NLP packages including corpora, models, and other resources. The flaw manifests when the system writes downloaded package bytes to disk and subsequently extracts them before performing cryptographic checksum validation, creating a window of opportunity for attackers to manipulate the download content.
The technical implementation of this vulnerability stems from improper order of operations within the download pipeline where file extraction occurs prior to integrity verification. This design flaw allows adversaries to intercept network traffic between the client and package repositories through various attack vectors including compromised mirrors, malicious proxies, or man-in-the-middle scenarios. When an attacker successfully substitutes package content during transit, the system extracts the malicious files before validating their cryptographic hashes, thereby accepting tainted content as legitimate. The vulnerability affects both SHA-256 and MD5 checksum validation mechanisms, rendering either form of integrity checking ineffective due to the timing issue.
The operational impact of this vulnerability extends beyond simple code execution to encompass broader security implications for NLP applications that rely on nltk's package management system. Downstream users and applications that trust the downloaded packages may unknowingly execute malicious code or process corrupted data, potentially leading to data exfiltration, system compromise, or disruption of NLP workflows. The attack surface is particularly concerning given that many NLP applications depend on pre-trained models and corpora that are downloaded automatically, making the vulnerability exploitable even in environments where users do not directly interact with package management commands.
This vulnerability aligns with common weakness enumerations such as CWE-20, which describes improper input validation, and CWE-345, addressing insufficient verification of data integrity. The attack pattern corresponds to MITRE ATT&CK techniques including T1190 for exploit public-facing application and T1059 for command and scripting interpreter, as attackers could potentially inject malicious code through compromised packages. Organizations using nltk versions prior to the fix face significant risk when operating in environments where network traffic interception is possible, particularly in shared or untrusted network conditions where man-in-the-middle attacks are prevalent.
Mitigation strategies should prioritize immediate upgrading to patched versions of nltk where the download and validation sequence has been corrected to perform integrity checks before file extraction. Network administrators should implement additional security measures including traffic monitoring, proxy filtering, and certificate pinning where possible to reduce the attack surface. Organizations should also consider implementing network segmentation and access controls to limit exposure to potentially compromised package repositories. Regular security audits of downloaded packages and implementation of automated vulnerability scanning for dependency management can help detect and prevent exploitation of similar timing-based validation flaws in other software ecosystems.