Executive brief
NLTK is a widely-used natural language processing library that downloads language models and corpora from remote mirrors. The library writes downloaded packages to disk and extracts them before verifying their checksums, enabling attackers to inject malicious content through compromised download mirrors or network interception. Applications relying on these downloaded models would unknowingly execute or trust the attacker-supplied content, potentially leading to data corruption or system compromise.
Technical details
The vulnerability is a download integrity verification bypass (CWE-494) in NLTK's nltk.downloader.Downloader._download_package() function. The root cause is that downloaded package bytes are written to disk and extracted before SHA-256 or MD5 checksum validation is performed. An attacker with network access (compromised mirror, malicious proxy, or MITM capability) can tamper with the package response body, causing the installation of attacker-controlled package bytes. No user interaction or privileges are required beyond network positioning; however, the attack has high complexity due to the need to intercept or compromise the mirror. Successful exploitation allows injection of malicious corpus or model files that downstream applications will trust and use. The advisory indicates no patches are available for this duplicate issue (superseded by GHSA-5wp5-5229-5g6q).
Affected products
- NLTK Project NLTK <= 3.9.2
Timeline
- 2026-08-03: disclosed
- 2026-09-01: other: Advisory withdrawn as duplicate of GHSA-5wp5-5229-5g6q