DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-78680: CVE-2026-78680: Arbitrary Code Execution in NLTK via Untrusted Graphviz Path Resolution

#security #cve #cybersecurity

CVE-2026-78680: Arbitrary Code Execution in NLTK via Untrusted Graphviz Path Resolution

Vulnerability ID: CVE-2026-78680
CVSS Score: 7.8
Published: 2026-09-01

An Untrusted Search Path (CWE-426) vulnerability exists in the Natural Language Toolkit (NLTK) library when executing the Graphviz 'dot' utility. Because the library fails to enforce absolute paths when executing external commands, local attackers can plant a malicious binary named 'dot' inside the current working directory. The library then executes the malicious binary, resulting in local arbitrary code execution under the context of the running Python process.

TL;DR

NLTK versions prior to 3.10.3 are vulnerable to local arbitrary code execution via an untrusted search path flaw when invoking the Graphviz 'dot' command.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-426, CWE-427
  • Attack Vector: Local (L)
  • CVSS v3.1 Score: 7.8 (High)
  • CVSS v4.0 Score: 8.5 (High)
  • EPSS Score: 0.0012 (Percentile: 2.07%)
  • Exploit Maturity: Proof of Concept (PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • NLTK library installations on Windows
  • NLTK library installations on Linux/macOS with relative directory entries in PATH
  • nltk: < 3.10.3 (Fixed in: 3.10.3)

Code Analysis

Commit: 1a3cd17

Fix Untrusted Search Path in Graphviz dot invocation in dependencygraph.py and api.py

Commit: 3767397

Merge pull request fixing local binary execution vulnerability

Exploit Details

  • VulnCheck: Analysis of the search path resolution bug in NLTK Graphviz integration

Mitigation Strategies

  • Upgrade NLTK dependency to version 3.10.3 or higher.
  • Remove relative directory markers (like '.') and empty paths from the system PATH environment variable.
  • Avoid running Python/NLTK scripts inside directories that contain untrusted or user-writeable files.

Remediation Steps:

  1. Identify current NLTK installations using command: pip show nltk
  2. Upgrade NLTK by running: pip install --upgrade nltk>=3.10.3
  3. Verify installation by checking version in Python: python -c "import nltk; print(nltk.version)"
  4. Ensure that local workspace directories do not contain arbitrary executables named 'dot' or 'dot.exe'

References

Read the full report for CVE-2026-78680 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)