NLTK up to 3.10.3 TreebankWordTokenizer TreebankWordTokenizer.span_tokenize special elements in template engine

Summaryinfo

A vulnerability identified as problematic has been detected in NLTK. The affected element is the function TreebankWordTokenizer.span_tokenize of the component TreebankWordTokenizer. The manipulation leads to special elements in template engine. This vulnerability is traded as CVE-2026-126300. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in NLTK and classified as problematic. This issue affects the function TreebankWordTokenizer.span_tokenize of the component TreebankWordTokenizer. The manipulation with an unknown input leads to a special elements in template engine vulnerability. Using CWE to declare the problem leads to CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Impacted is availability. The summary by CVE is:

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-126300 since 11/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1221 according to MITRE ATT&CK.

Upgrading to version 3.10.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• NLTK

Version

• 3.6.5
• 3.9.3
• 3.9.4
• 3.10.0
• 3.10.0-rc1
• 3.10.1
• 3.10.2
• 3.10.3

Website

• Product: https://github.com/nltk/nltk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion