What is CVE-2026-0848?

CVE-2026-0848 is a critical-severity vulnerability in Nltk, classified under Improper Input Validation. CVSS score: 10.0/10. Published 2026-03-05.

How severe is CVE-2026-0848?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Is CVE-2026-0848 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Nltk

CVE-2026-0848

NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can su…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.008 (51.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Nltk
Nltk Nltk/nltk — versions unspecified

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

References

security@huntr.dev (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-0848?: CVE-2026-0848 is a critical-severity vulnerability in Nltk, classified under Improper Input Validation. CVSS score: 10.0/10. Published 2026-03-05.
How severe is CVE-2026-0848?: Critical severity. CVSS v3 base score is 10.0 out of 10.
Is CVE-2026-0848 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.