CVE-2026-0848
published 2026-03-05CVE-2026-0848: NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads…
PriorityP269critical10CVSS 3.0
AVNACLPRNUINSCCHIHAH
EPSS
0.79%
55.7th percentile
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| debian | nltk | < nltk 3.9.3-1 (forky) | nltk 3.9.3-1 (forky) |
| nltk | nltk | <= 3.9.3 | — |
| nltk | nltk | <= 3.9.2 | — |
| nltk | nltk | >= 0 < 3.9.3-1 | 3.9.3-1 |
| nltk | nltk | >= 0 < 3.9.4 | 3.9.4 |
| nltk | nltk_nltk | unspecified – latest | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| ubuntu | nltk | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for subprocess.Popen() invocations spawned by the NLTK StanfordSegmenter module loading external JAR files without integrity verification — indicative of CVE-2026-0848 exploitation ↗
- →Alert on Java processes spawned as child processes of Python (NLTK) where the classpath argument includes user-controllable or externally-sourced .jar file paths, particularly via the StanfordSegmenter module ↗
- →Detect exploitation attempts via model poisoning, MITM, or dependency poisoning vectors that result in replacement of NLTK Stanford JAR files on disk ↗
- ·The fix for CVE-2026-0848 (SHA256 verification added to StanfordSegmenter) was NOT applied to five related Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, StanfordNeuralDependencyParser), which remain vulnerable through at least NLTK 3.9.3 under the separate CVE-2026-12252 ↗
- ·Red Hat assessed CVE-2026-0848 as no risk to their products because they control and verify the JAR supply chain; however, CVE-2026-12252 marks some OpenShift Lightspeed packages as Affected ↗
CVSS provenance
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ghsa10.0CRITICAL
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
vendor_ubuntu8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading
vendor_redhat·2026-07-04·CVSS 10.0
CVE-2026-12252 [CRITICAL] CWE-347 nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading
nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.
A flaw was found in the `nltk` library. Several Stanford interfa
Ubuntu
NLTK vulnerabilities
vendor_ubuntu·2026-05-25·CVSS 8.6
CVE-2026-33230 [HIGH] NLTK vulnerabilities
Title: NLTK vulnerabilities
Summary: Several security issues were fixed in NLTK.
It was discovered that NLTK incorrectly validated file paths when
opening files using the nltk.util module. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2026-0846)
It was discovered that NLTK incorrectly validated file paths in
multiple CorpusReader classes. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2026-0847)
It was discovered that NLTK did not properly validate external
Java archive files loaded by StanfordSegmenter. An attacker
could possibly use this issue to execute arbitrary code. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-0848)
It was discove
Red Hat
nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading
vendor_redhat·2026-03-05·CVSS 10.0
CVE-2026-0848 [CRITICAL] CWE-829 nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading
nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
A code injection flaw was found in nltk. The StanfordSegme
Debian
CVE-2026-0848: nltk - NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper...
vendor_debian·2026·CVSS 10.0
CVE-2026-0848 [CRITICAL] CVE-2026-0848: nltk - NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper...
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 3.9.3-1)
sid: resolved (fixed in 3.9.3-1)
trixie: open
GHSA
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulner
ghsa_unreviewed·2026-07-04·CVSS 10.0
CVE-2026-12252 [CRITICAL] CWE-94 In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulner
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.
GHSA
NLTK Stanford wrapper classes execute untrusted JAR files without verification
ghsa·2026-07-04·CVSS 10.0
CVE-2026-12252 [CRITICAL] CWE-94 NLTK Stanford wrapper classes execute untrusted JAR files without verification
NLTK Stanford wrapper classes execute untrusted JAR files without verification
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.
GHSA
GHSA-v2w2-xcg6-53wj: NLTK versions <=3
ghsa_unreviewed·2026-03-05
CVE-2026-0848 [CRITICAL] CWE-20 GHSA-v2w2-xcg6-53wj: NLTK versions <=3
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
OSV
CVE-2026-0848: NLTK versions <=3
osv·2026-03-05·CVSS 10.0
CVE-2026-0848 [CRITICAL] CVE-2026-0848: NLTK versions <=3
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12252 python-nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading [fedora-all]
bugzilla·2026-07-06·CVSS 10.0
CVE-2026-12252 [CRITICAL] CVE-2026-12252 python-nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading [fedora-all]
CVE-2026-12252 python-nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for Sta
Bugzilla
CVE-2026-12252 python-nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading [epel-all]
bugzilla·2026-07-06·CVSS 10.0
CVE-2026-12252 [CRITICAL] CVE-2026-12252 python-nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading [epel-all]
CVE-2026-12252 python-nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for Stanf
Bugzilla
CVE-2026-12252 nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading
bugzilla·2026-07-04·CVSS 10.0
CVE-2026-12252 [CRITICAL] CVE-2026-12252 nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading
CVE-2026-12252 nltk: nltk: Arbitrary Code Execution via Untrusted JAR File Loading
In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.
Bugzilla
CVE-2026-0848 nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading
bugzilla·2026-03-05·CVSS 10.0
CVE-2026-0848 [CRITICAL] CVE-2026-0848 nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading
CVE-2026-0848 nltk: NLTK: Arbitrary code execution via unvalidated Java Archive (JAR) file loading
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Wiz
CVE-2026-0848 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 10.0
CVE-2026-0848 [CRITICAL] CVE-2026-0848 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0848 :
Linux Debian vulnerability analysis and mitigation
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Source : NVD
## 10
Score
Published March 5, 2026
Severity CRITICAL
2026-03-05
Published