Executive brief
NLTK is a Python library for natural language processing that includes wrapper classes to invoke Stanford NLP tools via Java. A previous fix for JVM argument injection was incomplete, validating only global configuration but not per-call options. An attacker can bypass this validation by passing malicious JVM flags (like `-agentpath` or `-javaagent`) through the `java_options` parameter of Stanford wrapper classes, achieving arbitrary code execution on the server running NLTK.
Technical details
This is a CWE-88 argument injection vulnerability affecting the `java()` function in `nltk/internals.py`. The root cause is that while `config_java()` validates JVM options via `_validate_java_options()`, the `java()` function's per-call `options` parameter (added in PR #3683) bypasses this validation entirely and passes options directly to `subprocess.Popen`. All four Stanford wrapper classes (GenericStanfordParser, StanfordTagger, StanfordTokenizer, StanfordSegmenter) accept user-supplied `java_options` and route them through this unvalidated path. An attacker controlling the `java_options` parameter can inject dangerous flags including `-agentpath:/path/to/malicious.so` (native code execution), `-javaagent:/path/to/malicious.jar` (bytecode manipulation), `-agentlib:jdwp` (remote debugging), or `@argfile` (argument expansion). The vulnerability is exploitable in services where `java_options` derives from user input, configuration files, or environment variables. A patch is available in version 3.10.3 and later via a single-line addition calling `_validate_java_options()` on per-call options.
Affected products
- NLTK Project NLTK <= 3.10.2
Timeline
- 2026-09-01: disclosed: Advisory published
- 2026-09-01: patched: Version 3.10.3 released with fix
- 2026-08-11: other: Advisory initially published on GitHub