CVE-2026-12259
Description
A flaw was found in nltk. The nltk.downloader.Downloader._download_package() function does not enforce SHA-256 or MD5 checksum validation before writing and extracting downloaded package bytes to disk. A remote attacker can exploit this by tampering with the package response body through a compromised mirror, malicious proxy, or other source-substitution condition. This can lead to the installation of attacker-controlled package bytes, resulting in malicious content being trusted by downstream users or applications.
Statement
This Moderate flaw in the nltk library allows for the installation of attacker-controlled packages due to insufficient checksum validation during package download. An attacker could exploit this by compromising a package mirror or proxy, leading to the execution of arbitrary code or the introduction of malicious data into downstream applications that utilize nltk for natural language processing tasks. This risk is elevated in environments where nltk is used to fetch external data or models from untrusted sources.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
cve.org: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Other
Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.
Integrity,Other
Technical Impact: Other
Data that is parsed and used may be corrupted.
Non-Repudiation,Other
Technical Impact: Hide Activities; Other
Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
