CVE-2026-79675: NLTK JVM argument injection bypass in Stanford wrappers

CVE-2026-79675 · Severity: critical · CVSS 9.8 · Published 2026-08-25

NLTK is a Python library for natural language processing that includes wrapper classes to invoke Stanford NLP tools via Java. A previous fix for JVM argument injection was incomplete, validating only global configuration but not per-call options. An attacker can bypass this validation by passing malicious JVM flags (like `-agentpath` or `-javaagent`) through the `java_options` parameter of Stanford wrapper classes, achieving arbitrary code execution on the server running NLTK.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-79675 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79675 being exploited in the wild.
How severe is CVE-2026-79675?
Critical severity, with a CVSS score of 9.8, published 25 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.10.2, ECOSYSTEM:introduced=0,fixed=3.10.3.
Is there a fix for CVE-2026-79675?
Yes. nltk (PyPI): upgrade to 3.10.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79675 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-79675?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.10.3 or later
    pip install "nltk>=3.10.3"

Technical details

This is a CWE-88 argument injection vulnerability affecting the `java()` function in `nltk/internals.py`. The root cause is that while `config_java()` validates JVM options via `_validate_java_options()`, the `java()` function's per-call `options` parameter (added in PR #3683) bypasses this validation entirely and passes options directly to `subprocess.Popen`. All four Stanford wrapper classes (GenericStanfordParser, StanfordTagger, StanfordTokenizer, StanfordSegmenter) accept user-supplied `java_options` and route them through this unvalidated path. An attacker controlling the `java_options` parameter can inject dangerous flags including `-agentpath:/path/to/malicious.so` (native code execution), `-javaagent:/path/to/malicious.jar` (bytecode manipulation), `-agentlib:jdwp` (remote debugging), or `@argfile` (argument expansion). The vulnerability is exploitable in services where `java_options` derives from user input, configuration files, or environment variables. A patch is available in version 3.10.3 and later via a single-line addition calling `_validate_java_options()` on per-call options.

Affected products

  • NLTK Project NLTK <= 3.10.2

Identifiers

  • CVE-2026-79675
  • GHSA-m4rf-3fr8-xwx3
  • PYSEC-2026-3749

Timeline

  • 2026-09-01: disclosed: Advisory published
  • 2026-09-01: patched: Version 3.10.3 released with fix
  • 2026-08-11: other: Advisory initially published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.