CVE-2026-33236
🟠 Łataj w tym tygodniu
Brak walidacji atrybutów w NLTK downloaderze umożliwia atakującym tworzenie i nadpisywanie plików w systemie.
CVSS
8.1
EPSS
0.0%
Exploit
poc
Vendor
nltk
Opis źródłowy (NVD)
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.
exploit path-traversal
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.1 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-03-20 23:16:47 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-23 19:15:37 UTC |
Referencje
- https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a (security-advisories@github.com) [Patch]
- https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7 (security-advisories@github.com) [Exploit, Vendor Advisory]