CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

• CWE-94
• CWE-94

• https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4Exploit, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:10184
• https://access.redhat.com/security/cve/CVE-2025-14009
• https://bugzilla.redhat.com/show_bug.cgi?id=2440724
• https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4Exploit, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14009.json

Published

Feb 18, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14003The Image Gallery – Photo Grid & Video Gallery plugin for Wo…4.3
• CVE-2025-14004A security flaw has been discovered in dayrui XunRuiCMS up t…9.8
• CVE-2025-14005A weakness has been identified in dayrui XunRuiCMS up to 4.7…6.1
• CVE-2025-14006A security vulnerability has been detected in dayrui XunRuiC…6.1
• CVE-2025-14007A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1…6.1
• CVE-2025-14008A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This …7.2
• CVE-2025-1401The WP Click Info WordPress plugin through 2.7.4 does not sa…7.1
• CVE-2025-14010A flaw was found in ansible-collection-community-general. Th…5.5
• CVE-2025-14011A vulnerability was found in JIZHICMS up to 2.5.5. Impacted …7.2
• CVE-2025-14012A vulnerability was determined in JIZHICMS up to 2.5.5. The …7.2
• CVE-2025-14013A vulnerability was identified in JIZHICMS up to 2.5.5. The …4.8
• CVE-2025-14014Unrestricted Upload of File with Dangerous Type vulnerabilit…9.8