Source: nltk Version: 3.10.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for nltk. The fixed status for both is a bit unclear, can you investigate and report back please and adjust affected versions as needed please? CVE-2026-12243[0]: | NLTK version 3.9.4 is vulnerable to a path traversal attack due to | an incomplete fix for GitHub Issue #3504. The | `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal | `../` sequences but fails to account for percent-encoded traversal | sequences such as `..%2f`. The `url2pathname()` function decodes | these sequences after the validation step, allowing an attacker to | bypass the protection. This vulnerability enables an attacker to | read arbitrary files accessible to the Python process by controlling | the resource name parameter passed to `nltk.data.load()` or | `nltk.data.find()`. The issue affects applications that rely on NLTK | for resource loading, including NLP web applications, Jupyter | notebooks, and CLI tools. The default `pathsec.ENFORCE=False` | setting exacerbates the impact by not blocking the file read at the | `open()` stage. CVE-2026-12252[1]: | In nltk/nltk versions 3.9.3 and earlier, five Stanford interface | classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, | StanfordDependencyParser, and StanfordNeuralDependencyParser) are | vulnerable to untrusted JAR code execution. These classes accept | user-controllable JAR paths and execute them via the `java()` | function, which invokes `subprocess.Popen()` without integrity | verification. This vulnerability is identical to CVE-2026-0848, | which was fixed for StanfordSegmenter by adding SHA256 verification. | However, the fix was not applied to these additional classes, | leaving them susceptible to arbitrary code execution when loading | untrusted JAR files. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-12243 https://www.cve.org/CVERecord?id=CVE-2026-12243 [1] https://security-tracker.debian.org/tracker/CVE-2026-12252 https://www.cve.org/CVERecord?id=CVE-2026-12252 Regards, Salvatore
