Executive brief
NLTK is a popular Python library used for natural language processing tasks that includes wrappers for Stanford NLP tools. A validation bypass allows attackers to inject malicious Java arguments through wrapper class options, leading to arbitrary code execution on systems running NLTK-based services. This bypasses a prior security fix and could compromise applications that accept user-supplied configuration for NLP processing.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in NLTK's java() function. While a previous CVE-2026-12841 fix added _validate_java_options() to block dangerous JVM flags (like -agentpath, -javaagent, @argfile) when using config_java(), the validation was not applied to per-call options passed directly to java(). The four Stanford wrapper classes (GenericStanfordParser, StanfordTagger, StanfordTokenizer, StanfordSegmenter) accept user-supplied java_options and route them through the unvalidated per-call path, bypassing the fix entirely. An attacker can inject flags like -agentpath:/path/to/malicious.so or -javaagent:/path/to/malicious.jar to load arbitrary code within the JVM. The fix is to add _validate_java_options() call in the java() function's per-call options handling. Patched in NLTK 3.10.3.
Affected products
- NLTK Project NLTK < 3.10.3
Timeline
- 2026-08-25: disclosed
- 2026-08-11: patched: Version 3.10.3 patched