Vulnerability in Nltk Nltk/nltk
CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package…
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.
Affected products
- Nltk Nltk/nltk — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-12261?
- CVE-2026-12261 is a medium-severity vulnerability in Nltk Nltk/nltk, classified under Improper Access Control. CVSS score: 5.3/10. Published 2026-08-07.
- How severe is CVE-2026-12261?
- Medium severity. CVSS v3 base score is 5.3 out of 10.