Arbitrary Code Execution Vulnerability in NLTK by The NLTK Project

CVE-2026-78680

What is CVE-2026-78680?

NLTK prior to version 3.10.3 is susceptible to an arbitrary code execution vulnerability due to improper validation of absolute paths when calling the Graphviz dot binary in certain functions like dependencygraph.dot2img and AlignedSent.repr_svg. This flaw enables attackers to place a malicious dot binary in the search path or the current working directory. Consequently, when the NLTK library is invoked, it could inadvertently execute this malicious binary instead of the intended Graphviz tool, granting unauthorized access and control over the system.

References