Update dependency nltk to v3.9.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nltk (source)	==3.4.5 → ==3.9.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)

CVE-2021-43854 / GHSA-f8m6-h2c7-8h9x

More information

Details

Impact

The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. The effect of this vulnerability is noticeable with the following example:

from nltk.tokenize import word_tokenize

n = 8
for length in [10**i for i in range(2, n)]:
    # Prepare a malicious input
    text = "a" * length
    start_t = time.time()
    # Call `word_tokenize` and naively measure the execution time
    word_tokenize(text)
    print(f"A length of {length:<{n}} takes {time.time() - start_t:.4f}s")

Which gave the following output during testing:

A length of 100      takes 0.0060s
A length of 1000     takes 0.0060s
A length of 10000    takes 0.6320s
A length of 100000   takes 56.3322s
...

I canceled the execution of the program after running it for several hours.

If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK without the vulnerability, or applying the workaround described below.

Patches

The problem has been patched in NLTK 3.6.6. After the fix, running the above program gives the following result:

A length of 100      takes 0.0070s
A length of 1000     takes 0.0010s
A length of 10000    takes 0.0060s
A length of 100000   takes 0.0400s
A length of 1000000  takes 0.3520s
A length of 10000000 takes 3.4641s

This output shows a linear relationship in execution time versus input length, which is desirable for regular expressions.
We recommend updating to NLTK 3.6.6+ if possible.

Workarounds

The execution time of the vulnerable functions is exponential to the length of a malicious input. With other words, the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our recommendation is to implement such a limit.

References

• The issue showcasing the vulnerability: https://github.com/nltk/nltk/issues/2866
• The pull request containing considerably more information on the vulnerability, and the fix: https://github.com/nltk/nltk/pull/2869
• The commit containing the fix: 1405aad979c6b8080dbbc8e0858f89b2e3690341
• Information on CWE-1333: Inefficient Regular Expression Complexity: https://cwe.mitre.org/data/definitions/1333.html

For more information

If you have any questions or comments about this advisory:

• Open an issue in github.com/nltk/nltk
• Email us at nltk.team@gmail.com

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/nltk/nltk/security/advisories/GHSA-f8m6-h2c7-8h9x
• https://nvd.nist.gov/vuln/detail/CVE-2021-43854
• https://github.com/nltk/nltk/issues/2866
• https://github.com/nltk/nltk/pull/2869
• https://github.com/nltk/nltk/commit/1405aad979c6b8080dbbc8e0858f89b2e3690341
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2021-859.yaml
• https://github.com/advisories/GHSA-f8m6-h2c7-8h9x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK Vulnerable to REDoS

CVE-2021-3842 / GHSA-rqjh-jp2r-59cj

More information

Details

NLTK is vulnerable to REDoS in some RegexpTaggers used in the functions get_pos_tagger and malt_regex_tagger.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3842
• https://github.com/nltk/nltk/commit/2a50a3edc9d35f57ae42a921c621edc160877f4d
• https://huntr.dev/bounties/761a761e-2be2-430a-8d92-6f74ffe9866a
• https://github.com/nltk/nltk/pull/2906
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2022-5.yaml
• https://github.com/advisories/GHSA-rqjh-jp2r-59cj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK Vulnerable to REDoS

CVE-2021-3828 / GHSA-2ww3-fxvq-293j

More information

Details

The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [_read_comparison_block()(https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparative_sents.py#L259) function in the file nltk/corpus/reader/comparative_sents.py may cause an application to consume an excessive amount of CPU.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3828
• https://github.com/nltk/nltk/pull/2816
• https://github.com/nltk/nltk/commit/277711ab1dec729e626b27aab6fa35ea5efbd7e6
• https://huntr.dev/bounties/d19aed43-75bc-4a03-91a0-4d0bb516bc32
• https://github.com/advisories/GHSA-2ww3-fxvq-293j
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2021-356.yaml

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

ntlk unsafe deserialization vulnerability

CVE-2024-39705 / GHSA-cgvx-9447-vcch

More information

Details

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-39705
• https://github.com/nltk/nltk/issues/2522
• https://github.com/nltk/nltk/issues/3266
• https://github.com/nltk/nltk/commit/441aecb7d33014bd08672232c6c8bb69c2ceaba2
• https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2024-167.yaml
• https://github.com/advisories/GHSA-cgvx-9447-vcch

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK has a Zip Slip Vulnerability

CVE-2025-14009 / GHSA-7p94-766c-hgjp

More information

Details

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as init.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

Severity

• CVSS Score: 10.0 / 10 (Critical)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-14009
• https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4
• https://github.com/nltk/nltk/pull/3468
• https://github.com/nltk/nltk/commit/1056b323af6462455571302e766b67cf300aea18
• https://github.com/nltk/nltk/blob/4154eb85e832f266660a09286c7e37e308292284/ChangeLog#L1
• https://github.com/advisories/GHSA-7p94-766c-hgjp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

CVE-2026-33230 / GHSA-gfwx-w7gr-fvh7

More information

Details

Summary

nltk.app.wordnet_app contains a reflected cross-site scripting issue in the lookup_... route. A crafted lookup_<payload> URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application.

Details

The vulnerable flow is in nltk/app/wordnet_app.py:

• nltk/app/wordnet_app.py:144

  • Requests starting with lookup_ are handled as HTML responses:
  • page, word = page_from_href(sp)

• nltk/app/wordnet_app.py:755

  • page_from_href() calls page_from_reference(Reference.decode(href))

• nltk/app/wordnet_app.py:769

  • word = href.word

• nltk/app/wordnet_app.py:796

  • If no results are found, word is inserted directly into the HTML body:
  • body = "The word or words '%s' were not found in the dictionary." % word

This is inconsistent with the search route, which does escape user input:

• nltk/app/wordnet_app.py:136
  • word = html.escape(...)

As a result, a malicious lookup_... payload can inject script into the response page.

The issue is exploitable because:

• Reference.decode() accepts attacker-controlled base64-encoded pickle data for the URL state.
• The decoded word is reflected into HTML without html.escape().
• The server is started with HTTPServer(("", port), MyServerHandler), so it listens on all interfaces by default, not just localhost.

PoC

1. Start the WordNet Browser in an isolated Docker environment:

docker run -d --name nltk-wordnet-web -p 8002:8002 \
  nltk-sandbox \
  python -c "import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8002, False)"

2. Use the following crafted payload, which decodes to:

("<script>alert(1)</script>", {})

Encoded payload:

gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4=

3. Request the vulnerable route:

curl -s "http://127.0.0.1:8002/lookup_gAWVIQAAAAAAAACMGTxzY3JpcHQ-YWxlcnQoMSk8L3NjcmlwdD6UfZSGlC4="

4. Observed result:

The word or words '<script>alert(1)</script>' were not found in the dictionary.

I also validated the issue directly at function level in Docker:

import base64
import pickle

from nltk.app.wordnet_app import page_from_href

payload = base64.urlsafe_b64encode(
    pickle.dumps(("<script>alert(1)</script>", {}), -1)
).decode()

page, word = page_from_href(payload)
print(word)
print("<script>alert(1)</script>" in page)

Observed output:

WORD= <script>alert(1)</script>
HAS_SCRIPT= True

Impact

This is a reflected XSS issue in the NLTK WordNet Browser web UI.

An attacker who can convince a user to open a crafted lookup_... URL can execute arbitrary JavaScript in the origin of the local WordNet Browser application. This can be used to:

• run arbitrary script in the browser tab
• manipulate the page content shown to the user
• issue same-origin requests to other WordNet Browser routes
• potentially trigger available UI actions in that local app context

This primarily impacts users who run nltk.app.wordnet_app as a local or self-hosted HTTP service and open attacker-controlled links.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7
• https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
• https://nvd.nist.gov/vuln/detail/CVE-2026-33230
• https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
• https://github.com/advisories/GHSA-gfwx-w7gr-fvh7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Unauthenticated remote shutdown in nltk.app.wordnet_app

CVE-2026-33231 / GHSA-jm6w-m3j8-898g

More information

Details

Summary

nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service.

Details

The vulnerable logic is in nltk/app/wordnet_app.py:

• nltk/app/wordnet_app.py:242

  • The server listens on all interfaces:
  • server = HTTPServer(("", port), MyServerHandler)

• nltk/app/wordnet_app.py:87

  • Incoming requests are checked for the exact path:
  • if unquote_plus(sp) == "SHUTDOWN THE SERVER":

• nltk/app/wordnet_app.py:88

  • The shutdown protection only depends on server_mode

• nltk/app/wordnet_app.py:93

  • In the default mode (runBrowser=True, therefore server_mode=False), the handler terminates the process directly:
  • os._exit(0)

This means any party that can reach the listening port can stop the service with a single unauthenticated GET request when the browser is started in its normal mode.

PoC

1. Start the WordNet Browser in Docker in its default mode:

docker run -d --name nltk-wordnet-web-default-retest -p 8004:8004 \
  nltk-sandbox \
  python -c "import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8004, True)"

2. Confirm the service is reachable:

curl -s -o /tmp/wn_before.html -w '%{http_code}\n' 'http://127.0.0.1:8004/'

Observed result:

200

3. Trigger shutdown:

curl -s -o /tmp/wn_shutdown.html -w '%{http_code}\n' 'http://127.0.0.1:8004/SHUTDOWN%20THE%20SERVER'

Observed result:

000

4. Verify the service is no longer available:

curl -s -o /tmp/wn_after.html -w '%{http_code}\n' 'http://127.0.0.1:8004/'
docker ps -a --filter name=nltk-wordnet-web-default-retest --format '{{.Names}}\t{{.Status}}'
docker logs nltk-wordnet-web-default-retest

Observed results:

000
nltk-wordnet-web-default-retest    Exited (0)
Server shutting down!

Impact

This is an unauthenticated denial-of-service issue in the NLTK WordNet Browser HTTP server.

Any reachable client can terminate the service remotely when the application is started in its default mode. The impact is limited to service availability, but it is still security-relevant because:

• the route is accessible over HTTP
• no authentication or CSRF-style confirmation is required
• the server listens on all interfaces by default
• the process exits immediately instead of performing a controlled shutdown

This primarily affects users who run nltk.app.wordnet_app and expose or otherwise allow access to its listening port.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g
• https://nvd.nist.gov/vuln/detail/CVE-2026-33231
• https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b
• https://github.com/advisories/GHSA-jm6w-m3j8-898g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

CVE-2026-0846 / GHSA-h8wq-7xc4-p3qx

More information

Details

A vulnerability in the filestring() function of the nltk.util module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-0846
• https://huntr.com/bounties/007b84f8-418e-4300-99d0-bf504c2f97eb
• https://github.com/nltk/nltk/pull/3485
• https://github.com/nltk/nltk/commit/b2e1164bf89277f79b65406c829b99fb20ca1974
• https://github.com/advisories/GHSA-h8wq-7xc4-p3qx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nltk/nltk (nltk)

v3.9.4

Compare Source

v3.9.3

Compare Source

v3.9.2

Compare Source

v3.9.1

Compare Source

v3.9

Compare Source

v3.8.1

Compare Source

v3.8

Compare Source

v3.7

Compare Source

v3.6.7

Compare Source

v3.6.6

Compare Source

v3.6.5

Compare Source

v3.6.4

Compare Source

v3.6.3

Compare Source

v3.6.2

Compare Source

v3.6.1

Compare Source

v3.6

Compare Source

v3.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud