Executive brief
NLTK is a popular natural language processing library used by developers and researchers worldwide. The package downloader feature allows users to fetch language models and data from remote repositories. A vulnerability exists where downloaded packages are not cryptographically verified before installation, allowing an attacker on the network (or controlling DNS) to inject malicious code. This could lead to arbitrary code execution when developers use the automated download feature.
Technical details
The vulnerability is a missing integrity check (CWE-494) in nltk/downloader.py. The download flow downloads files via HTTP to a temp location, moves them to the final location via os.replace() (line 799), and then extracts them via _unzip_iter() (line 825). No SHA-256 verification occurs between the move and extraction steps, despite checksum logic existing in _pkg_status() (used only before download as a staleness check). An attacker can intercept HTTP traffic, exploit DNS poisoning, or use filesystem race conditions to replace the file before extraction. The PoC demonstrates mocking urllib to return a malicious zip file that would be installed without detection. Patch 3.9.3 adds SHA-256 verification post-download by calling the existing checksum function after file placement.
Affected products
- NLTK Project NLTK <= 3.9.2
Timeline
- 2026-08-07: disclosed: Published to GitHub Advisory Database
- 2026-09-08: patched: Version 3.9.3 released with SHA-256 post-download verification
References
- https://github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q
- https://github.com/nltk/nltk/pull/3449
- https://github.com/nltk/nltk/commit/0e26734a61094b628d93e26dc18dd7302567ac46
- https://github.com/nltk/nltk/releases/tag/3.9.3
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3729.yaml