Update dependency nltk to v3.9.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nltk (source)	==3.6.6 → ==3.9.4

---

ntlk unsafe deserialization vulnerability

CVE-2024-39705 / GHSA-cgvx-9447-vcch

More information

Details

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-39705
• https://github.com/nltk/nltk/issues/2522
• https://github.com/nltk/nltk/issues/3266
• https://github.com/nltk/nltk/commit/441aecb7d33014bd08672232c6c8bb69c2ceaba2
• https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2024-167.yaml
• https://github.com/advisories/GHSA-cgvx-9447-vcch

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK has a Zip Slip Vulnerability

CVE-2025-14009 / GHSA-7p94-766c-hgjp

More information

Details

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as init.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14009
• https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4
• https://github.com/nltk/nltk/pull/3468
• https://github.com/nltk/nltk/commit/1056b323af6462455571302e766b67cf300aea18
• https://github.com/nltk/nltk/blob/4154eb85e832f266660a09286c7e37e308292284/ChangeLog#L1
• https://github.com/advisories/GHSA-7p94-766c-hgjp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

CVE-2026-33230 / GHSA-gfwx-w7gr-fvh7

More information

Details

Summary

nltk.app.wordnet_app contains a reflected cross-site scripting issue in the lookup_... route. A crafted lookup_<payload> URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application.

Details

The vulnerable flow is in nltk/app/wordnet_app.py:

• nltk/app/wordnet_app.py:144

  • Requests starting with lookup_ are handled as HTML responses:
  • page, word = page_from_href(sp)

• nltk/app/wordnet_app.py:755

  • page_from_href() calls page_from_reference(Reference.decode(href))

• nltk/app/wordnet_app.py:769

  • word = href.word

• nltk/app/wordnet_app.py:796

  • If no results are found, word is inserted directly into the HTML body:
  • body = "The word or words '%s' were not found in the dictionary." % word

This is inconsistent with the search route, which does escape user input:

• nltk/app/wordnet_app.py:136
  • word = html.escape(...)

As a result, a malicious lookup_... payload can inject script into the response page.

The issue is exploitable because:

• Reference.decode() accepts attacker-controlled base64-encoded pickle data for the URL state.
• The decoded word is reflected into HTML without html.escape().
• The server is started with HTTPServer(("", port), MyServerHandler), so it listens on all interfaces by default, not just localhost.

PoC

1. Start the WordNet Browser in an isolated Docker environment:

docker run -d --name nltk-wordnet-web -p 8002:8002 \
  nltk-sandbox \
  python -c "import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8002, False)"

2. Use the following crafted payload, which decodes to:

("<script>alert(1)</script>", {})

Encoded payload:

gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4=

3. Request the vulnerable route:

curl -s "http://127.0.0.1:8002/lookup_gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4="

4. Observed result:

The word or words '<script>alert(1)</script>' were not found in the dictionary.

I also validated the issue directly at function level in Docker:

import base64
import pickle

from nltk.app.wordnet_app import page_from_href

payload = base64.urlsafe_b64encode(
    pickle.dumps(("<script>alert(1)</script>", {}), -1)
).decode()

page, word = page_from_href(payload)
print(word)
print("<script>alert(1)</script>" in page)

Observed output:

WORD= <script>alert(1)</script>
HAS_SCRIPT= True

Impact

This is a reflected XSS issue in the NLTK WordNet Browser web UI.

An attacker who can convince a user to open a crafted lookup_... URL can execute arbitrary JavaScript in the origin of the local WordNet Browser application. This can be used to:

• run arbitrary script in the browser tab
• manipulate the page content shown to the user
• issue same-origin requests to other WordNet Browser routes
• potentially trigger available UI actions in that local app context

This primarily impacts users who run nltk.app.wordnet_app as a local or self-hosted HTTP service and open attacker-controlled links.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7
• https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
• https://nvd.nist.gov/vuln/detail/CVE-2026-33230
• https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
• https://github.com/advisories/GHSA-gfwx-w7gr-fvh7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

CVE-2026-0846 / GHSA-h8wq-7xc4-p3qx

More information

Details

A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-0846
• https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
• https://github.com/nltk/nltk/pull/3485
• https://github.com/nltk/nltk/commit/b2e1164bf89277f79b65406c829b99fb20ca1974
• https://github.com/advisories/GHSA-h8wq-7xc4-p3qx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nltk/nltk (nltk)

v3.9.4

Compare Source

v3.9.3

Compare Source

v3.9.2

Compare Source

v3.9.1

Compare Source

v3.9

Compare Source

v3.8.1

Compare Source

v3.8

Compare Source

v3.7

Compare Source

v3.6.7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.