Zaloguj się
Deutsch English Español Polski
Wysoka

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

  • Ujawniono: 01.09.2026
  • Aktualizacja: 11.10.2026 15:18

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks (the CWD on Windows, or a writable/relative entry such as . on PATH) has their binary executed in place of Graphviz (arbitrary code execution).

Affected (<= 3.10.2):

  • nltk.parse.dependencygraph.dot2img — called find_binary("dot") but discarded the returned validated path and then ran the bare name ["dot", ...], so the validation had no effect.
  • nltk.translate.api.AlignedSent._repr_svg_ — ran the bare name with no validation at all (IPython SVG rendering).

This is the same class already fixed for the senna, weka, boxer, malt, repp and hunpos wrappers. nltk.internals.find_binary refuses a CWD-relative match for a bare tool name and returns only a trusted absolute path; the fix runs that path in both sites.

Attack demonstration

Captured output, not illustrative. A ./dot that writes a PWNED marker, planted in the CWD with . prepended to PATH.

The vulnerable behaviour (old bare-name exec):

Control (OLD behavior) — bare ['dot'] in this dir with '.' on PATH:
  bare ['dot'] executed planted binary = True

The patched functions refuse it:

FIXED code, with ./dot planted and '.' on PATH:
  dependencygraph.dot2img : Exception "Cannot find the dot binary..."  | planted-binary-executed=False  safe
  AlignedSent._repr_svg_  : Exception "Cannot find the dot binary..."  | planted-binary-executed=False  safe

And find_binary itself was attacked directly (the fix trusts nothing else):

Attack 1: ./dot in CWD, no dot on PATH            -> LookupError (refused)  safe
Attack 2: ./dot/dot (dir 'dot' holding 'dot')     -> LookupError (refused)  safe
Attack 3: '.' on PATH + ./dot                     -> LookupError (refused)  safe
Attack 4: attacker-writable ABSOLUTE dir on PATH  -> returned /…/evilbin/dot (absolute)

Attack 4 is out of scope: trusting an absolute directory that is already on PATH is the operating system's own trust model — an attacker who can write to a PATH directory owns the account regardless of NLTK. find_binary defends specifically against the CWD/relative injection that bare-name exec is vulnerable to (attacks 1–3), which is exactly what this fix inherits.

Environment: python 3.13.7. dot is not required to reproduce — the planted binary is the payload.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Python (PyPI) nltk < 3.10.3 3.10.3

Odnośniki

Ocena CVSS 7.8/10
Wektor CVSS
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Słabość (CWE)
CWE-426, CWE-427
Platforma
Python (PyPI)
Paczka
nltk
Ujawniono
01.09.2026
Aktualizacja
11.10.2026 15:18

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2026-3868 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-6hwm-xvph-95vm - CC BY 4.0

Historia podatności: nltk

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (52) w archiwum
Wszystkich wpisów
52
Pierwsza → ostatnia
08.2019 09.2026
Bez poprawki
6
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 5
  • Wysoka 32
  • Średnia 13
  • Niska 2

Ujawnienia w latach

Istotność:
  1. NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary ten wpis
    Wysoka · 7.8 CVE-2026-78680 < 3.10.3 3.10.3
  2. NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
    Wysoka · 7.0 CVE-2026-81726 <= 3.10.3 brak poprawki
  3. NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
    Wysoka CVE-2026-80206 < 3.10.3 3.10.3
  4. NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
    Wysoka · 7.5 CVE-2026-80205 < 3.10.0 3.10.0
  5. NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
    Krytyczna · 9.8 CVE-2026-79675 < 3.10.3 3.10.3
  6. NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
    Wysoka CVE-2026-79676 < 3.10.3 3.10.3
  7. NLTK: Corpus Reader Sandbox Bypass
    Wysoka CVE-2026-79674 < 3.10.3 3.10.3
  8. NLTK: Allowlisted pickle loaders still permit code execution in current source
    Krytyczna CVE-2026-79657 < 3.10.3 3.10.3
  9. NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
    Krytyczna CVE-2026-78683 < 3.10.0 3.10.0
  10. NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
    Wysoka CVE-2026-78681 < 3.10.3 3.10.3
  11. NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
    Wysoka CVE-2026-78682 < 3.10.3 3.10.3
  12. NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution
    Wysoka · 8.8 CVE-2026-71513 >= 3.10.0, < 3.10.3 3.10.3
  13. NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
    Wysoka · 6.2 CVE-2026-70626 < 3.9.4 3.9.4
  14. NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
    Wysoka CVE-2026-63312 < 3.10.0 3.10.0
  15. NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
    Wysoka · 7.5 CVE-2026-62384 >= 3.10.0, < 3.10.2 3.10.2
  16. NLTK: Stable FrameNet and NKJP readers parse outside-root XML
    Wysoka · 5.9 CVE-2026-62385 < 3.10.0 3.10.0
  17. NLTK: Default ENFORCE=False Disables All pathsec Security Controls
    Wysoka CVE-2026-62388 < 3.10.0 3.10.0
  18. NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
    Wysoka · 7.5 CVE-2026-72818 < 3.10.1 3.10.1
  19. Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
    Wysoka · 8.6 CVE-2026-12075 < 3.10.0 3.10.0
  20. Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
    Wysoka · 7.5 CVE-2026-12061 < 3.10.0 3.10.0
  21. Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
    Wysoka · 7.5 CVE-2026-12072 < 3.10.0 3.10.0
  22. Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
    Wysoka · 7.5 CVE-2026-12074 < 3.10.0 3.10.0
  23. NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arb
    Wysoka CVE-2025-71408 < 3.9.3 3.9.3
  24. In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulner
    Wysoka · 7.8 CVE-2026-12252 < 3.9.4 3.9.4
  25. NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but
    Wysoka · 7.5 CVE-2026-12243 <= 3.9.4 brak poprawki
  26. Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
    Wysoka · 7.5 CVE-2026-54293 < 3.10.0 3.10.0
  27. NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
    Wysoka · 8.1 CVE-2026-33236 <= 3.9.2 brak poprawki
  28. Unauthenticated remote shutdown in nltk.app.wordnet_app
    Wysoka · 7.5 CVE-2026-33231 < 3.9.4 3.9.4
  29. A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files s
    Wysoka · 7.5 CVE-2026-0846 <= 3.9.2 brak poprawki
  30. NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verific
    Krytyczna · 10.0 CVE-2026-0848 < 3.9.3 3.9.3
  31. A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and Brack
    Wysoka · 7.5 CVE-2026-0847 < 3.9.3 3.9.3
  32. NLTK has a Zip Slip Vulnerability
    Krytyczna · 10.0 CVE-2025-14009 < 3.9.3 3.9.3
  33. ntlk unsafe deserialization vulnerability
    Wysoka · 7.5 CVE-2024-39705 < 3.9 3.9
  34. NLTK Vulnerable to REDoS
    Wysoka · 7.5 CVE-2021-3842 < 3.6.6 3.6.6
  35. Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)
    Wysoka · 7.5 CVE-2021-43854 < 3.6.6 3.6.6
  36. NLTK Vulnerable to REDoS
    Wysoka · 7.5 CVE-2021-3828 < 3.6.4 3.6.4
  37. NLTK Vulnerable To Path Traversal
    Wysoka · 7.5 CVE-2019-14751 < 3.4.5 3.4.5

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.