Nltk vulnerabilities
45 CVEs and advisories name Nltk as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109956NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path
- CVE-2026-81727NLTK before 3.10.3 Hardlink File Overwrite via downloader
- CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIs
- CVE-2026-81725NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader
- CVE-2026-81724NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
- CVE-2026-81723NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
- CVE-2026-81722nltk PorterStemmer before 3.10.3 Quadratic-time DoS
- CVE-2026-80206NLTK 3.10.2 Regular Expression Denial of Service via tgrep
- CVE-2026-80205NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex
- CVE-2026-79676NLTK before 3.10.3 Path Traversal via Symlink Bypass
- CVE-2026-79675NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
- CVE-2026-79674NLTK 3.10.2 Path Traversal via corpus-reader constructors
- CVE-2026-79657NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-78683NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-78682NLTK before 3.10.3 SSRF Protection Bypass via Proxy
- CVE-2026-78681NLTK before 3.10.3 Entity Expansion DoS via ElementTree
- CVE-2026-78680NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary
- CVE-2026-70626NLTK before 3.9.4 Symlink Escape via CorpusReader
- CVE-2026-66393NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder
- CVE-2026-65915NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer
- CVE-2026-63312NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read
- CVE-2026-63311NLTK before 3.10.0 SSRF via DNS Resolution Failure
- CVE-2026-62388NLTK before 3.10.0 Insecure Default Configuration in pathsec.py
- CVE-2026-62385NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers
- CVE-2026-62384NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2
- CVE-2026-62383nltk IPIPANCorpusReader Symlink Arbitrary File Read
- CVE-2026-71514NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass
- CVE-2026-71513NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass
- CVE-2026-72818NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input
- CVE-2026-12372Server-Side Request Forgery (SSRF) in nltk/nltk