SB2026031817 - Multiple vulnerabilities in Natural Language Toolkit

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026031817

SB2026031817 - Multiple vulnerabilities in Natural Language Toolkit

Published: March 18, 2026 Updated: August 7, 2026

Security Bulletin ID SB2026031817
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 60% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion in JSONTaggedDecoder.decode_obj(). A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


2) Missing Authentication for Critical Function (CVE-ID: CVE-2026-33231)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper access control in nltk.app.wordnet_app when handling requests. A remote attacker can send a request to shut down the application to cause a denial of service.


3) Cross-site scripting (CVE-ID: CVE-2026-33230)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to inject arbitrary script code.

The vulnerability exists due to cross-site scripting in web page generation when rendering unsanitized input. A remote attacker can craft malicious input to inject arbitrary script code.

User interaction is required to trigger the issue.


4) Path traversal (CVE-ID: CVE-2026-33236)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite arbitrary files.

The vulnerability exists due to path traversal in the downloader component when processing user-supplied download paths. A remote attacker can supply a specially crafted path to overwrite arbitrary files.

User interaction is required to initiate the download process.


5) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper link resolution before file access in nltk.corpus.reader.api.CorpusReader.open() and FileSystemPathPointer.join() when opening corpus files through a symlink placed under the corpus root. A local user can place or influence a symlinked path inside the allowed corpus root to disclose sensitive information.

The issue bypasses the intended filesystem boundary because the path check is performed on the lexical path rather than the resolved path after following symlinks.


Remediation

Install update from vendor's website.

References