Executive brief
NLTK is a Python library for natural language processing. Versions before 3.10.3 fail to validate the absolute path when invoking the Graphviz dot binary for visualizing dependency graphs and rendering aligned sentence output, allowing an attacker with local access to execute arbitrary code by placing a malicious dot binary in the current directory or writable PATH locations. This could lead to complete system compromise if NLTK is used in a context where untrusted code or data is processed.
Technical details
This is a path injection vulnerability (CWE-426, CWE-427) in NLTK's invocation of the Graphviz dot binary. The vulnerable code paths are in nltk.parse.dependencygraph.dot2img and nltk.translate.api.AlignedSent._repr_svg_, which either call find_binary("dot") but then execute the bare name ["dot", ...] instead of the validated path, or execute the bare name with no validation at all. On Windows, the current working directory (CWD) is checked first in binary resolution; on Unix-like systems, relative PATH entries like "." are searched. An attacker with local access can place a malicious dot binary in the CWD or a writable PATH directory to achieve arbitrary code execution under the privileges of the NLTK process. The fix, available in version 3.10.3, uses the validated absolute path returned by find_binary instead of the bare tool name. Low privileges are required to exploit this (the user must be able to write to the working directory or modify PATH), and there is no user interaction needed once the malicious binary is in place.
Affected products
- NLTK NLTK <= 3.10.2
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fix released in NLTK 3.10.3
- 2026-09-01: advisory: Original advisory GHSA-54xp-3ww7-6wjg withdrawn as duplicate of GHSA-6hwm-xvph-95vm on Sep 1, 2026