CVE-2026-78680 in Nltk
Summary
by MITRE • 08/25/2026
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Natural Language Toolkit (NLTK) versions prior to 3.10.3 represents a critical security flaw rooted in improper input validation and insecure dynamic search path resolution. This issue specifically affects functions that interface with external system binaries, namely dependencygraph.dot2img and AlignedSent.repr_svg. These components are responsible for generating visual representations of linguistic structures by invoking the Graphviz dot binary. The core technical deficiency lies in the method used to locate and execute this external program. Instead of resolving a validated absolute path or explicitly specifying the full pathname of the legitimate Graphviz executable, NLTK relies on bare-name resolution mechanisms provided by the underlying operating system's command interpreter. This approach assumes that the first instance of dot found in the execution environment is the intended, safe utility, thereby failing to verify the integrity and origin of the binary being executed.
The operational impact of this flaw allows for arbitrary code execution through a technique known as path traversal or search path hijacking. On Windows systems, attackers can exploit the default behavior where the current working directory is included in the executable search order before system directories. By placing a malicious script or executable named dot.exe within the same directory from which NLTK is invoked, an attacker ensures that their payload takes precedence over the legitimate Graphviz tool. Similarly, on Unix-like operating systems such as Linux and macOS, if relative paths are present in the PATH environment variable preceding the actual installation location of Graphviz, a malicious binary placed in one of those directories will be executed instead. This mechanism bypasses standard security controls because the application itself does not validate that it is interacting with an authorized software component, effectively trusting user-controlled file system locations for critical execution decisions.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-426 Untrusted Search Path. The failure to use validated absolute paths constitutes a classic instance of insecure dynamic search path resolution. In the context of the MITRE ATT&CK framework, this exploitation technique maps directly to T1059 Command and Scripting Interpreter, specifically leveraging the operating system's native command execution capabilities without proper validation. It also relates to T1204 User Execution if an attacker can trick a user into running NLTK scripts from a malicious directory, or potentially T1036 Masquerading if the malicious binary is designed to mimic legitimate behavior while performing unauthorized actions in the background. The severity of this issue is heightened by its potential for remote code execution when integrated into web applications or automated pipelines that process untrusted natural language data and generate visual outputs without sandboxing.
Mitigation strategies must focus on enforcing strict path validation and eliminating reliance on bare-name resolution for critical system binaries. For NLTK users, the immediate remediation involves upgrading to version 3.10.3 or later, where this logic has been corrected to utilize validated absolute paths. Developers integrating NLTK into larger applications should implement additional safeguards by explicitly defining the full path to the Graphviz dot binary in their configuration settings rather than relying on environment variables alone. Furthermore, organizations should enforce strict PATH variable configurations that prioritize system directories over user-writable locations and disable current working directory inclusion in search orders where possible. Security monitoring tools can also be configured to alert on unexpected executions of binaries named dot from non-standard directories, providing an additional layer of defense against exploitation attempts targeting this specific class of vulnerabilities.