Description

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T16:17:28.013Z",
  "pubdate": "2026-08-25T16:17:28.013Z",
  "executiveSummary": "NLTK versions prior to 3.10.3 are susceptible to an argument injection vulnerability within the java() function, which acts as a wrapper for Stanford NLP tools. The vulnerability arises from a lack of sanitization for user-supplied JVM options passed during function execution.\nBy injecting arbitrary JVM flags, an attacker can manipulate the Java Runtime Environment (JRE) process spawned by the library. This allows for the execution of malicious code, unauthorized access, or the bypassing of security restrictions.\nThe attack is viable in any environment where user input can influence the arguments passed to the java() function. This poses a critical risk to applications integrating NLTK with external or untrusted data, potentially leading to full system compromise depending on the privileges of the executing process.\nSuccessful exploitation allows for arbitrary code execution (ACE) on the host machine. There are no known complex prerequisites other than the ability to influence the function parameters, making this a high-impact vulnerability that requires immediate attention and patching to the specified secure version.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the NLTK library's java() function. This function is designed to interface with Stanford NLP Java-based wrappers, accepting an options parameter intended for JVM-specific configurations.\nThe implementation fails to enforce a whitelist or sanitization policy on the contents of the options parameter. Consequently, the input is passed directly to the command-line execution of the Java virtual machine without filtering for dangerous flags or arguments.\nAn attacker can exploit this by crafting a malicious options string that includes flags such as -agentpath or -javaagent. By pointing these flags to an attacker-controlled library or JAR file, the attacker can hijack the JVM initialization process to execute arbitrary native or Java code.\nFurthermore, the use of @argfile allows an attacker to reference an external file containing a list of arbitrary arguments, providing a mechanism to bypass length restrictions or character filtering that might be present in upstream application code.\nThe attack flow follows these steps: 1. The attacker identifies an entry point where user-provided input is passed to the NLTK java() function's options parameter. 2. The attacker injects malicious JVM flags (e.g., -javaagent:/tmp/malicious.jar). 3. The NLTK library invokes the Java runtime, appending the malicious flags to the command string. 4. The JRE interprets the injected flags, loading the attacker's payload into the process memory space. 5. The payload executes with the same permissions as the application running NLTK, enabling post-exploitation activities such as shell access, data exfiltration, or persistence.\nThis vulnerability is present in all NLTK versions prior to 3.10.3. Because the java() function does not distinguish between legitimate configuration flags and malicious directives, the risk of exploitation is high. Authentication or specific privilege levels are not inherent requirements for the vulnerability itself, but are instead dependent on the security posture of the surrounding application environment.\nThe impact is significant, as it effectively elevates an argument injection vulnerability into arbitrary code execution. Once the JRE is compromised via flag injection, the security boundaries of the NLTK library and the host Python process are effectively neutralized."
}