nltk vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-81725Mediumnltk: NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocksCVE-2026-80206Highnltk: NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressionsCVE-2026-80205Highnltk: NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressionsCVE-2026-79674Highnltk: NLTK: Corpus Reader Sandbox BypassCVE-2026-79676Highnltk: NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcementCVE-2026-79657Criticalnltk: NLTK: Allowlisted pickle loaders still permit code execution in current sourceCVE-2026-78681Highnltk: NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parsesCVE-2026-78682Highnltk: NLTK: pathsec SSRF protection can be bypassed when a proxy is configuredCVE-2026-78683Criticalnltk: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code ExecutionCVE-2026-62383Mediumnltk: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirelyCVE-2026-62384Highnltk: NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)CVE-2026-62385Highnltk: NLTK: Stable FrameNet and NKJP readers parse outside-root XMLCVE-2026-12259Mediumnltk: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package InjectionCVE-2026-63312Highnltk: NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File ReadCVE-2026-65915Mediumnltk: NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocolCVE-2026-70626Highnltk: NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus rootCVE-2026-62388Highnltk: NLTK: Default ENFORCE=False Disables All pathsec Security ControlsCVE-2026-63311Mediumnltk: NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution FailureCVE-2026-81722Mediumnltk: NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'CVE-2026-81727Mediumnltk: NLTK: Downloader.download follows hardlinks and overwrites outside-root filesCVE-2026-81726Highnltk: NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed rootsCVE-2026-81723Mediumnltk: NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`CVE-2026-12876Mediumnltk: NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammarsCVE-2026-81724Mediumnltk: NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure…CVE-2026-79675Criticalnltk: NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo