Iniciar sesión
Deutsch English Español Polski
Alta

NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

  • Publicada: 01.09.2026
  • Actualizado: 11.10.2026 15:18

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks (the CWD on Windows, or a writable/relative entry such as . on PATH) has their binary executed in place of Graphviz (arbitrary code execution).

Affected (<= 3.10.2):

  • nltk.parse.dependencygraph.dot2img — called find_binary("dot") but discarded the returned validated path and then ran the bare name ["dot", ...], so the validation had no effect.
  • nltk.translate.api.AlignedSent._repr_svg_ — ran the bare name with no validation at all (IPython SVG rendering).

This is the same class already fixed for the senna, weka, boxer, malt, repp and hunpos wrappers. nltk.internals.find_binary refuses a CWD-relative match for a bare tool name and returns only a trusted absolute path; the fix runs that path in both sites.

Attack demonstration

Captured output, not illustrative. A ./dot that writes a PWNED marker, planted in the CWD with . prepended to PATH.

The vulnerable behaviour (old bare-name exec):

Control (OLD behavior) — bare ['dot'] in this dir with '.' on PATH:
  bare ['dot'] executed planted binary = True

The patched functions refuse it:

FIXED code, with ./dot planted and '.' on PATH:
  dependencygraph.dot2img : Exception "Cannot find the dot binary..."  | planted-binary-executed=False  safe
  AlignedSent._repr_svg_  : Exception "Cannot find the dot binary..."  | planted-binary-executed=False  safe

And find_binary itself was attacked directly (the fix trusts nothing else):

Attack 1: ./dot in CWD, no dot on PATH            -> LookupError (refused)  safe
Attack 2: ./dot/dot (dir 'dot' holding 'dot')     -> LookupError (refused)  safe
Attack 3: '.' on PATH + ./dot                     -> LookupError (refused)  safe
Attack 4: attacker-writable ABSOLUTE dir on PATH  -> returned /…/evilbin/dot (absolute)

Attack 4 is out of scope: trusting an absolute directory that is already on PATH is the operating system's own trust model — an attacker who can write to a PATH directory owns the account regardless of NLTK. find_binary defends specifically against the CWD/relative injection that bare-name exec is vulnerable to (attacks 1–3), which is exactly what this fix inherits.

Environment: python 3.13.7. dot is not required to reproduce — the planted binary is the payload.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) nltk < 3.10.3 3.10.3

Referencias

Puntuación CVSS 7.8/10
Vector CVSS
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Debilidad (CWE)
CWE-426, CWE-427
Plataforma
Python (PyPI)
Paquete
nltk
Publicada
01.09.2026
Actualizado
11.10.2026 15:18

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-3868 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-6hwm-xvph-95vm - CC BY 4.0

Historial de vulnerabilidades: nltk

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (52) en el archivo
Entradas en total
52
Primera → última
08.2019 09.2026
Sin corrección
6
Explotada en ataques
0

Distribución por gravedad

  • Crítica 5
  • Alta 32
  • Media 13
  • Baja 2

Divulgaciones por año

Gravedad:
  1. NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary esta entrada
    Alta · 7.8 CVE-2026-78680 < 3.10.3 3.10.3
  2. NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
    Alta · 7.0 CVE-2026-81726 <= 3.10.3 sin corrección
  3. NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
    Alta CVE-2026-80206 < 3.10.3 3.10.3
  4. NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
    Alta · 7.5 CVE-2026-80205 < 3.10.0 3.10.0
  5. NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)
    Crítica · 9.8 CVE-2026-79675 < 3.10.3 3.10.3
  6. NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
    Alta CVE-2026-79676 < 3.10.3 3.10.3
  7. NLTK: Corpus Reader Sandbox Bypass
    Alta CVE-2026-79674 < 3.10.3 3.10.3
  8. NLTK: Allowlisted pickle loaders still permit code execution in current source
    Crítica CVE-2026-79657 < 3.10.3 3.10.3
  9. NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
    Crítica CVE-2026-78683 < 3.10.0 3.10.0
  10. NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
    Alta CVE-2026-78681 < 3.10.3 3.10.3
  11. NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
    Alta CVE-2026-78682 < 3.10.3 3.10.3
  12. NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution
    Alta · 8.8 CVE-2026-71513 >= 3.10.0, < 3.10.3 3.10.3
  13. NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
    Alta · 6.2 CVE-2026-70626 < 3.9.4 3.9.4
  14. NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
    Alta CVE-2026-63312 < 3.10.0 3.10.0
  15. NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
    Alta · 7.5 CVE-2026-62384 >= 3.10.0, < 3.10.2 3.10.2
  16. NLTK: Stable FrameNet and NKJP readers parse outside-root XML
    Alta · 5.9 CVE-2026-62385 < 3.10.0 3.10.0
  17. NLTK: Default ENFORCE=False Disables All pathsec Security Controls
    Alta CVE-2026-62388 < 3.10.0 3.10.0
  18. NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
    Alta · 7.5 CVE-2026-72818 < 3.10.1 3.10.1
  19. Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
    Alta · 8.6 CVE-2026-12075 < 3.10.0 3.10.0
  20. Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
    Alta · 7.5 CVE-2026-12061 < 3.10.0 3.10.0
  21. Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
    Alta · 7.5 CVE-2026-12072 < 3.10.0 3.10.0
  22. Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
    Alta · 7.5 CVE-2026-12074 < 3.10.0 3.10.0
  23. NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arb
    Alta CVE-2025-71408 < 3.9.3 3.9.3
  24. In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulner
    Alta · 7.8 CVE-2026-12252 < 3.9.4 3.9.4
  25. NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but
    Alta · 7.5 CVE-2026-12243 <= 3.9.4 sin corrección
  26. Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
    Alta · 7.5 CVE-2026-54293 < 3.10.0 3.10.0
  27. NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
    Alta · 8.1 CVE-2026-33236 <= 3.9.2 sin corrección
  28. Unauthenticated remote shutdown in nltk.app.wordnet_app
    Alta · 7.5 CVE-2026-33231 < 3.9.4 3.9.4
  29. A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files s
    Alta · 7.5 CVE-2026-0846 <= 3.9.2 sin corrección
  30. NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verific
    Crítica · 10.0 CVE-2026-0848 < 3.9.3 3.9.3
  31. A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and Brack
    Alta · 7.5 CVE-2026-0847 < 3.9.3 3.9.3
  32. NLTK has a Zip Slip Vulnerability
    Crítica · 10.0 CVE-2025-14009 < 3.9.3 3.9.3
  33. ntlk unsafe deserialization vulnerability
    Alta · 7.5 CVE-2024-39705 < 3.9 3.9
  34. NLTK Vulnerable to REDoS
    Alta · 7.5 CVE-2021-3842 < 3.6.6 3.6.6
  35. Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)
    Alta · 7.5 CVE-2021-43854 < 3.6.6 3.6.6
  36. NLTK Vulnerable to REDoS
    Alta · 7.5 CVE-2021-3828 < 3.6.4 3.6.4
  37. NLTK Vulnerable To Path Traversal
    Alta · 7.5 CVE-2019-14751 < 3.4.5 3.4.5

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.