Remote Code Execution Vulnerability in NLTK Downloader by NLTK

CVE-2025-14009

What is CVE-2025-14009?

A serious vulnerability in the NLTK downloader component exposes users to potential remote code execution risks. The _unzip_iter function in nltk/downloader.py utilizes zipfile.extractall() without adequate path validation or security checks. This oversight permits attackers to create malicious zip packages that, when extracted by NLTK, can run arbitrary code. As NLTK presumes all downloaded packages are trustworthy, this vulnerability can be exploited by embedding executable Python files within malicious packages, thereby making unauthorized code execution a possibility. The ramifications include potential full system compromise, unauthorized file system access, and network breaches, leading to the establishment of persistent threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References