Update dependency nltk to v3.9.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nltk (source)	==3.6.6 → ==3.9.4

---

ntlk unsafe deserialization vulnerability

CVE-2024-39705 / GHSA-cgvx-9447-vcch

More information

Details

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-39705
• https://github.com/nltk/nltk/issues/2522
• https://github.com/nltk/nltk/issues/3266
• https://github.com/nltk/nltk/commit/441aecb7d33014bd08672232c6c8bb69c2ceaba2
• https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2024-167.yaml
• https://github.com/advisories/GHSA-cgvx-9447-vcch

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK has a Zip Slip Vulnerability

CVE-2025-14009 / GHSA-7p94-766c-hgjp

More information

Details

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as init.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14009
• https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4
• https://github.com/nltk/nltk/pull/3468
• https://github.com/nltk/nltk/commit/1056b323af6462455571302e766b67cf300aea18
• https://github.com/nltk/nltk/blob/4154eb85e832f266660a09286c7e37e308292284/ChangeLog#L1
• https://github.com/advisories/GHSA-7p94-766c-hgjp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

CVE-2026-33230 / GHSA-gfwx-w7gr-fvh7

More information

Details

Summary

nltk.app.wordnet_app contains a reflected cross-site scripting issue in the lookup_... route. A crafted lookup_<payload> URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application.

Details

The vulnerable flow is in nltk/app/wordnet_app.py:

• nltk/app/wordnet_app.py:144

  • Requests starting with lookup_ are handled as HTML responses:
  • page, word = page_from_href(sp)

• nltk/app/wordnet_app.py:755

  • page_from_href() calls page_from_reference(Reference.decode(href))

• nltk/app/wordnet_app.py:769

  • word = href.word

• nltk/app/wordnet_app.py:796

  • If no results are found, word is inserted directly into the HTML body:
  • body = "The word or words '%s' were not found in the dictionary." % word

This is inconsistent with the search route, which does escape user input:

• nltk/app/wordnet_app.py:136
  • word = html.escape(...)

As a result, a malicious lookup_... payload can inject script into the response page.

The issue is exploitable because:

• Reference.decode() accepts attacker-controlled base64-encoded pickle data for the URL state.
• The decoded word is reflected into HTML without html.escape().
• The server is started with HTTPServer(("", port), MyServerHandler), so it listens on all interfaces by default, not just localhost.

PoC

1. Start the WordNet Browser in an isolated Docker environment:

docker run -d --name nltk-wordnet-web -p 8002:8002 \
  nltk-sandbox \
  python -c "import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8002, False)"

2. Use the following crafted payload, which decodes to:

("<script>alert(1)</script>", {})

Encoded payload:

gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4=

3. Request the vulnerable route:

curl -s "http://127.0.0.1:8002/lookup_gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4="

4. Observed result:

The word or words '<script>alert(1)</script>' were not found in the dictionary.

I also validated the issue directly at function level in Docker:

import base64
import pickle

from nltk.app.wordnet_app import page_from_href

payload = base64.urlsafe_b64encode(
    pickle.dumps(("<script>alert(1)</script>", {}), -1)
).decode()

page, word = page_from_href(payload)
print(word)
print("<script>alert(1)</script>" in page)

Observed output:

WORD= <script>alert(1)</script>
HAS_SCRIPT= True

Impact

This is a reflected XSS issue in the NLTK WordNet Browser web UI.

An attacker who can convince a user to open a crafted lookup_... URL can execute arbitrary JavaScript in the origin of the local WordNet Browser application. This can be used to:

• run arbitrary script in the browser tab
• manipulate the page content shown to the user
• issue same-origin requests to other WordNet Browser routes
• potentially trigger available UI actions in that local app context

This primarily impacts users who run nltk.app.wordnet_app as a local or self-hosted HTTP service and open attacker-controlled links.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7
• https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
• https://nvd.nist.gov/vuln/detail/CVE-2026-33230
• https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
• https://github.com/advisories/GHSA-gfwx-w7gr-fvh7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Unauthenticated remote shutdown in nltk.app.wordnet_app

CVE-2026-33231 / GHSA-jm6w-m3j8-898g

More information

Details

Summary

nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service.

Details

The vulnerable logic is in nltk/app/wordnet_app.py:

• nltk/app/wordnet_app.py:242

  • The server listens on all interfaces:
  • server = HTTPServer(("", port), MyServerHandler)

• nltk/app/wordnet_app.py:87

  • Incoming requests are checked for the exact path:
  • if unquote_plus(sp) == "SHUTDOWN THE SERVER":

• nltk/app/wordnet_app.py:88

  • The shutdown protection only depends on server_mode

• nltk/app/wordnet_app.py:93

  • In the default mode (runBrowser=True, therefore server_mode=False), the handler terminates the process directly:
  • os._exit(0)

This means any party that can reach the listening port can stop the service with a single unauthenticated GET request when the browser is started in its normal mode.

PoC

1. Start the WordNet Browser in Docker in its default mode:

docker run -d --name nltk-wordnet-web-default-retest -p 8004:8004 \
  nltk-sandbox \
  python -c "import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8004, True)"

2. Confirm the service is reachable:

curl -s -o /tmp/wn_before.html -w '%{http_code}\n' 'http://127.0.0.1:8004/'

Observed result:

200

3. Trigger shutdown:

curl -s -o /tmp/wn_shutdown.html -w '%{http_code}\n' 'http://127.0.0.1:8004/SHUTDOWN%20THE%20SERVER'

Observed result:

000

4. Verify the service is no longer available:

curl -s -o /tmp/wn_after.html -w '%{http_code}\n' 'http://127.0.0.1:8004/'
docker ps -a --filter name=nltk-wordnet-web-default-retest --format '{{.Names}}\t{{.Status}}'
docker logs nltk-wordnet-web-default-retest

Observed results:

000
nltk-wordnet-web-default-retest    Exited (0)
Server shutting down!

Impact

This is an unauthenticated denial-of-service issue in the NLTK WordNet Browser HTTP server.

Any reachable client can terminate the service remotely when the application is started in its default mode. The impact is limited to service availability, but it is still security-relevant because:

• the route is accessible over HTTP
• no authentication or CSRF-style confirmation is required
• the server listens on all interfaces by default
• the process exits immediately instead of performing a controlled shutdown

This primarily affects users who run nltk.app.wordnet_app and expose or otherwise allow access to its listening port.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g
• https://nvd.nist.gov/vuln/detail/CVE-2026-33231
• https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b
• https://github.com/advisories/GHSA-jm6w-m3j8-898g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

CVE-2026-0846 / GHSA-h8wq-7xc4-p3qx

More information

Details

A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-0846
• https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
• https://github.com/nltk/nltk/pull/3485
• https://github.com/nltk/nltk/commit/b2e1164bf89277f79b65406c829b99fb20ca1974
• https://github.com/advisories/GHSA-h8wq-7xc4-p3qx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nltk/nltk (nltk)

v3.9.4

Compare Source

v3.9.3

Compare Source

v3.9.2

Compare Source

v3.9.1

Compare Source

v3.9

Compare Source

v3.8.1

Compare Source

v3.8

Compare Source

v3.7

Compare Source

v3.6.7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.