Executive brief
NLTK is a popular Python library for natural language processing that includes wrapper classes for Stanford NLP tools, which invoke Java code. A vulnerability allows attackers who can control the java_options parameter to inject dangerous JVM flags (like -agentpath or -javaagent), leading to arbitrary code execution on systems running NLTK as a service. This bypasses a previous security fix and can be exploited if user input influences the options passed to Stanford wrapper classes.
Technical details
This is a JVM argument injection vulnerability (CWE-88) that represents an incomplete fix of CVE-2026-12841. The original fix added _validate_java_options() to block dangerous JVM flags, but the validation is only applied when using config_java() for global options. The java() function's per-call options parameter—used by GenericStanfordParser, StanfordTagger, StanfordTokenizer, and StanfordSegmenter—passes options directly to subprocess.Popen without validation. An attacker who controls the java_options parameter can inject dangerous flags like -agentpath, -javaagent, -Xrunjdwp, or @argfile to achieve arbitrary code execution. No authentication is required; the vulnerability is exploitable when NLTK is exposed as a service and java_options derives from user input or configuration. A patch is available in version 3.10.3, which adds validation to the java() function's per-call options handling.
Affected products
- NLTK NLTK before 3.10.3
Timeline
- 2026-08-25: disclosed
- 2026-08-11: patched: Fix available in NLTK 3.10.3
- 2026-09-01: other: Original advisory GHSA-3h2g-j4wp-7qqq withdrawn as duplicate of GHSA-m4rf-3fr8-xwx3