Local File Execution Vulnerability in NLTK by nltk
CVE-2026-128134

7.8HIGH

Key Information:

Vendor

Nltk

Status
Nltk
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128134?

The NLTK (Natural Language Toolkit) vulnerability allows local low-privileged attackers to exploit the execution of the Graphviz dot executable through PATH without proper ownership and writability validation. By manipulating a directory writable by the victim, an attacker can alter or plant a malicious 'dot' executable. This poses a significant risk when invoking the dot2img function or rendering dependency graphs, potentially allowing code execution within the context of the victim user. The issue has been addressed in version 3.10.4.

Affected Version(s)

nltk < 3.10.4

References

https://github.com/nltk/nltk/security/advisories/GHSA-7mx...
x_refsource_CONFIRM
https://github.com/nltk/nltk/pull/3887
x_refsource_MISC
https://github.com/nltk/nltk/commit/b002a7288c22db86fd6ca...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.