CVE-2026-33236: NLTK path traversal in downloader component

CVE-2026-33236 · Severity: high · CVSS 8.1 · Published 2026-03-20

The Natural Language Toolkit (NLTK), a popular Python library for processing human language data, contains a security flaw in its data downloader component. If a user is tricked into downloading data from a malicious server, an attacker can create or overwrite files anywhere on the user's computer. This could lead to a total system compromise if critical system files or security keys are replaced by the attacker.

Technologies: nltk (PyPI), Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed. Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-33236 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33236 being exploited in the wild.
How severe is CVE-2026-33236?
High severity, with a CVSS score of 8.1, published 20 March 2026.
Which products and versions are affected?
nltk (PyPI) < 3.9.4, ECOSYSTEM:introduced=0,fixed=3.9.4, ECOSYSTEM:introduced=0,last_affected=3.9.2.
Is there a fix for CVE-2026-33236?
Yes. nltk (PyPI): upgrade to 3.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33236 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33236?
Check whether you run nltk (PyPI), Red Hat Lightspeed Core or Red Hat OpenShift Lightspeed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.9.4 or later
    pip install "nltk>=3.9.4"

Technical details

A path traversal vulnerability exists in the NLTK downloader (nltk/downloader.py) due to insufficient validation of the 'subdir' and 'id' attributes within remote XML index files. An attacker who controls a remote XML index server can provide malicious values containing sequences like '../'. When a victim uses the downloader to fetch a package from this malicious source, the library uses these unvalidated strings to construct file paths via os.path.join(). This allows the attacker to escape the intended download directory and perform arbitrary file creation or overwriting (AFO) on the local filesystem. The issue is patched in commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a.

Affected products

  • nltk nltk <= 3.9.3
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Lightspeed Core
  • Red Hat OpenShift Lightspeed
  • Red Hat Red Hat Ansible Automation Platform 2

Identifiers

  • CVE-2026-33236
  • GHSA-469j-vmhf-r6v7
  • PYSEC-2026-2237

Timeline

  • 2026-03-18: advisory: GitHub Security Advisory published
  • 2026-03-20: disclosed: NVD publication date
  • 2026-04-23: patched: Red Hat released security updates for OpenShift AI

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.