CVE-2026-12261

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

• CWE-284

• https://huntr.com/bounties/8b8c381e-08a8-4e4f-bb46-a320c96a364fPermissions Required
• https://huntr.com/bounties/8b8c381e-08a8-4e4f-bb46-a320c96a364fPermissions Required

Published

Aug 7, 2026

Last Modified

Oct 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12256Deserialization of Untrusted Data vulnerability in ThemeFusi…8.8
• CVE-2026-12257Versions of Mura CMS prior to 10.0.712 contain a critical re…9.3
• CVE-2026-12258Inadequate access control in Hiperdino’s REST v1.0 API. The …9.2
• CVE-2026-12259In nltk version 3.9.4, the `nltk.downloader.Downloader._down…6.5
• CVE-2026-1226CWE‑94: Improper Control of Generation of Code vulnerability…7
• CVE-2026-12260SQL injection in the NetBoard CRM demo platform; specificall…10
• CVE-2026-12263Zohocorp ManageEngine Password Manager Pro versions before 1…8.8
• CVE-2026-12264Zoho Corporation ManageEngine DDI Central versions 6200 and …8.8
• CVE-2026-12265Zoho Corporation ManageEngine DDI Central versions 6200 and …8.8
• CVE-2026-122659Missing Authorization vulnerability in WP ManageNinja LLC Fl…5.4
• CVE-2026-12266Zoho Corporation ManageEngine DDI Central versions 6200 and …7.6
• CVE-2026-122660Missing Authorization vulnerability in BAKKBONE Australia Fl…4.3