Insecure Package Management in NLTK by NLTK Team
CVE-2026-12259

5.3MEDIUM

Key Information:

Vendor

Nltk

Status
Nltk/nltk
Vendor
CVE Published:
3 August 2026

What is CVE-2026-12259?

In version 3.9.4 of NLTK, the 'Downloader._download_package()' function writes downloaded package bytes directly to disk without verifying integrity through SHA-256 or MD5 checksums. This flaw allows attackers to inject malicious data into package downloads from compromised mirrors or proxies, potentially leading to the installation of harmful content that can be trusted by users and applications downstream.

Affected Version(s)

nltk/nltk <= unspecified

References

https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633...

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.