What is CVE-2026-63310?

CVE-2026-63310 is a high-severity vulnerability in Nltk, classified under Download of Code Without Integrity Check. CVSS score: 7.1/10. Published 2026-08-22.

How severe is CVE-2026-63310?

High severity. CVSS v3 base score is 7.1 out of 10.

Vulnerability in Nltk

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H.

Affected products

Nltk

Weakness classification (CWE)

CWE-494 — Download of Code Without Integrity Check

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-63310?: CVE-2026-63310 is a high-severity vulnerability in Nltk, classified under Download of Code Without Integrity Check. CVSS score: 7.1/10. Published 2026-08-22.
How severe is CVE-2026-63310?: High severity. CVSS v3 base score is 7.1 out of 10.