{"schemaVersion":3,"id":"USN-8302-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"nltk vulnerabilities\n\nIt was discovered that NLTK incorrectly validated file paths when\nopening files using the nltk.util module. An attacker could possibly\nuse this issue to obtain sensitive information. (CVE-2026-0846)\n\nIt was discovered that NLTK incorrectly validated file paths in\nmultiple CorpusReader classes. An attacker could possibly use\nthis issue to obtain sensitive information. (CVE-2026-0847)\n\nIt was discovered that NLTK did not properly validate external\nJava archive files loaded by StanfordSegmenter. An attacker\ncould possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-0848)\n\nIt was discovered that NLTK's WordNet browser application\nincorrectly handled user-supplied input. An attacker could\npossibly use this issue to perform a cross-site scripting\nattack. (CVE-2026-33230)\n\nIt was discovered that NLTK's WordNet browser application did\nnot restrict access to the shutdown endpoint. A remote attacker\ncould possibly use this issue to cause a denial of service.\n(CVE-2026-33231)\n\nIt was discovered that NLTK's downloader did not validate path\nattributes in remote XML index files. An attacker could possibly\nuse this issue to create or overwrite arbitrary files.\n(CVE-2026-33236)","dates":{"published":"2026-05-25T15:53:15.000Z","modified":"2026-06-30T18:16:27.294Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"nltk","name":"nltk","label":"nltk","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/nltk","purlType":"deb","versions":[{"text":"< 2.0~b9-0ubuntu4.1~esm6","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1-1ubuntu0.1+esm4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.2.5-1ubuntu0.1+esm4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.4.5-2ubuntu0.1~esm4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.7-1ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.8.1-1ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.9.2-1ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0~b9-0ubuntu4.1~esm6 | < 3.1-1ubuntu0.1+esm4 | < 3.2.5-1ubuntu0.1+esm4 | < 3.4.5-2ubuntu0.1~esm4 | < 3.7-1ubuntu0.1~esm2 | < 3.8.1-1ubuntu0.1~esm2 | < 3.9.2-1ubuntu0.1~esm2","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8302-1","label":"ubuntu.com/security/notices/USN-8302-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-0846","label":"ubuntu.com/security/CVE-2026-0846","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-0847","label":"ubuntu.com/security/CVE-2026-0847","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-0848","label":"ubuntu.com/security/CVE-2026-0848","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-33230","label":"ubuntu.com/security/CVE-2026-33230","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-33231","label":"ubuntu.com/security/CVE-2026-33231","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-33236","label":"ubuntu.com/security/CVE-2026-33236","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2026-0846","CVE-2026-0847","CVE-2026-0848","CVE-2026-33230","CVE-2026-33231","CVE-2026-33236"]},"timeline":[{"kind":"published","date":"2026-05-25T15:53:15.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-30T18:16:27.294Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:56:38.793Z","stale":false,"partial":false}}