CVE-2026-12259
published 2026-08-03CVE-2026-12259: In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before…
PriorityP432medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.10%
0.9th percentile
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| nltk | nltk | — | — |
| nltk | nltk | >= 0 < 3.9.3 | 3.9.3 |
| nltk | nltk_nltk | unspecified – latest | — |
| openshift-lightspeed-tech-preview | lightspeed-rag-tool-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-ta-lmes-job-rhel9 | — | — |
| rhoai | odh-trustyai-garak-lls-provider-dsp-rhel9 | — | — |
| rhoai | odh-trustyai-nemo-guardrails-server-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
ghsa9.8CRITICAL
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation
vendor_redhat·2026-08-03·CVSS 5.3
CVE-2026-12259 [MEDIUM] CWE-354 nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation
nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
A flaw was found in nltk. The `nltk.downloader.Downloader._download_package()` function does not enforce SHA-256 or MD5 checksum validation before writing a
GHSA
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
ghsa·2026-09-08·CVSS 9.8
CVE-2026-12259 [CRITICAL] CWE-494 NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction.
The download flow at lines 789-825:
1. File is downloaded to a temp path via HTTP
2. os.replace(tmp_filepath, filepath) moves it to the final location (line 799)
3. Extraction begins via _unzip_iter() (line 825)
Between steps 2 and 3, there is no SHA-256 verification. The checksum logic exists in _pkg_status() (lines 982-1015) but it is only used BEFORE download as a status check ("is this package already installed and up-to-date?"). It is never called after download to verify the file that was actually received.
Attack vectors:
1. MITM during HTTP download (NLTK downloads from http://
VulDB
nltk up to 3.9.4 Downloader nltk.downloader.Downloader._download_package weak password hash
vuldb·2026-09-01·CVSS 5.3
CVE-2026-12259 [MEDIUM] nltk up to 3.9.4 Downloader nltk.downloader.Downloader._download_package weak password hash
A vulnerability was found in nltk up to 3.9.4. It has been declared as problematic. Affected is the function nltk.downloader.Downloader._download_package of the component Downloader. Such manipulation leads to password hash with insufficient computational effort.
This vulnerability is listed as CVE-2026-12259. The attack may be performed from remote. There is no available exploit.
GHSA
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation.
ghsa_unreviewed·2026-08-03
CVE-2026-12259 [MEDIUM] CWE-494 In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation.
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-12259 python-nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation [epel-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-12259 [MEDIUM] CVE-2026-12259 python-nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation [epel-all]
CVE-2026-12259 python-nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerabilit
Bugzilla
CVE-2026-12259 python-nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-12259 [MEDIUM] CVE-2026-12259 python-nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation [fedora-all]
CVE-2026-12259 python-nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerabil
Bugzilla
CVE-2026-12259 nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation
bugzilla·2026-08-03·CVSS 5.3
CVE-2026-12259 [MEDIUM] CVE-2026-12259 nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation
CVE-2026-12259 nltk: nltk: Installation of attacker-controlled packages due to improper checksum validation
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
2026-08-03
Published