What is CVE-2026-33230?

CVE-2026-33230 is a medium-severity vulnerability in Nltk, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-03-20.

How severe is CVE-2026-33230?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Nltk

CVE-2026-33230

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` contains a reflected…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.000 (5.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Nltk — versions <= 3.9.3

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7 (x_refsource_CONFIRM)
https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f (x_refsource_MISC)
https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-33230?: CVE-2026-33230 is a medium-severity vulnerability in Nltk, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-03-20.
How severe is CVE-2026-33230?: Medium severity. CVSS v3 base score is 6.1 out of 10.