CVE-2026-12252: fallo de gravedad alta en nltk/nltk
Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.2%
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
nltk · nltk/nltkCVEs relacionadas — nltk/nltk
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-3828HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.6%CVE-2021-3842HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.6%CVE-2025-14009HIGHZip Slip Vulnerability in nltk/nltk Leading to Remote Code ExecutionEPSS 1.0%CVE-2026-0847HIGHPath Traversal in nltk/nltkEPSS 1.0%CVE-2026-0848CRITICALArbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR LoadingEPSS 0.8%CVE-2026-0846HIGHArbitrary File Read via Absolute Path Input in nltk.util.filestring()EPSS 0.6%