CVE-2026-78682: nltk Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2026-78682 is a high (CVSS 8.7) Server-Side Request Forgery (SSRF) vulnerability in nltk. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-08-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.