Description

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-22T15:16:19.100Z",
  "pubdate": "2026-08-22T15:16:19.100Z",
  "executiveSummary": "An insecure file integrity verification vulnerability exists in the Natural Language Toolkit (NLTK) before version 3.9.3 within its downloader module. The vulnerability allows remote attackers to execute man-in-the-middle (MitM) attacks or perform DNS poisoning to intercept download streams and inject malicious package contents. Because the application fails to validate the cryptographic integrity of downloaded package archives prior to extraction, arbitrary files can be written to the underlying filesystem with the privileges of the running NLTK process. The impact of this security flaw includes remote code execution, unauthorized data modification, and complete system compromise of the affected environment. The risk implications are severe for automated pipelines, development environments, and production deployments that fetch natural language processing corpora and models over unencrypted or untrusted networks. Attackers require positioning on the network path between the client and the update server or the ability to manipulate DNS resolution. No special authentication is required for exploitation, and the attack vector is network-based, targeting the downloader module during runtime acquisition of external assets.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of post-download validation mechanisms within the NLTK downloader module. Specifically, when NLTK retrieves packages prior to version 3.9.3, the software initiates an HTTP/HTTPS or otherwise network-retrieved download process, storing the incoming archive locally without subsequently verifying cryptographic hashes, such as SHA-256 or MD5 sums, against a trusted manifest before initiating the archive extraction phase.\nThe vulnerable component is the downloader module responsible for managing external corpora and model packages. Affected versions include all NLTK releases prior to 3.9.3. The vulnerability is exploitable remotely over the network without requiring prior authentication or elevated privileges, provided the adversary can intercept or spoof network traffic.\nThe attack flow proceeds in a step-by-step manner. First, an application utilizing NLTK initiates a request to download a specific package or corpus via the downloader module. Second, an attacker positioned on the network path intercepts this communication channel through man-in-the-middle techniques or executes a DNS poisoning attack to redirect the download request to a malicious server controlled by the adversary. Third, the malicious server responds with a crafted package archive containing arbitrary payloads disguised as a legitimate NLTK package. Fourth, the NLTK downloader module accepts the incoming data stream, saves the archive locally, and directly passes the file to the extraction routine without performing integrity checks or checksum verifications. Finally, the extraction mechanism unpacks the malicious contents into the target directory, potentially overwriting critical application files, placing malicious scripts into execution paths, or deploying web shells depending on the surrounding context.\nThe payload behavior during post-exploitation depends heavily on the files injected during the extraction phase. Because NLTK often runs within Python environments executing scripts or web applications, malicious payload placement can lead to arbitrary code execution when the application subsequently attempts to load or process the compromised corpus data. This results in full control over the runtime environment, compromising data confidentiality, integrity, and availability."
}