CVE-2026-12259: Improper Integrity Verification (Extract-Before-Verify) in NLTK Downloader
Vulnerability ID: CVE-2026-12259
CVSS Score: 5.3
Published: 2026-09-08
An improper integrity verification vulnerability exists in the Natural Language Toolkit (NLTK) library up to and including version 3.9.4. The library's download utility writes remote ZIP packages directly to disk and extracts their contents onto the filesystem before executing cryptographic checksum validation. An attacker capable of intercepting or manipulating the download stream can exploit this behavior to perform arbitrary file writes, directory traversal, or execute untrusted serialized content.
TL;DR
NLTK's downloader extracts remote packages to the local filesystem before verifying their cryptographic hash, allowing man-in-the-middle or mirror-hijacking attackers to write arbitrary files or execute untrusted code.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-494
- Attack Vector: Network
- CVSS: 5.3
- EPSS Score: 0.001
- Impact: High Integrity Impact
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- Python environments running NLTK installations
-
nltk: <= 3.9.4 (Fixed in:
3.9.5)
Code Analysis
Commit: 0e26734
Switch checksum validation from MD5 to SHA-256 inside the NLTK downloader package status check.
Mitigation Strategies
- Upgrade NLTK to a version containing a complete validation sequence.
- Pre-populate and statically bundle NLTK datasets during image builds to eliminate the need for runtime downloader usage.
- Restrict network access to validated NLTK package repositories and use only secure HTTPS channels.
Remediation Steps:
- Identify all instances of NLTK in production systems and verify their versions.
- Update the library dependencies to ensure the latest patches are applied.
- Modify codebase to avoid calling nltk.download() dynamically at application startup.
- Configure firewalls or proxies to block unencrypted outbound connections to NLTK mirrors.
References
- https://www.cve.org/CVERecord?id=CVE-2026-12259
- https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633c35a5d
- https://github.com/nltk/nltk/pull/3449
- https://github.com/nltk/nltk/commit/0e26734a61094b628d93e26dc18dd7302567ac46
- https://github.com/nltk/nltk/issues/3407
- https://github.com/nltk/nltk/releases/tag/3.9.3
- https://www.wiz.io/vulnerability-database/cve/cve-2026-12259
Read the full report for CVE-2026-12259 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)