CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.

• CWE-918

• https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxhExploit, Vendor Advisory
• https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxyThird Party Advisory
• https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxhExploit, Vendor Advisory

Published

Aug 25, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78677GitPython before 3.1.59 omits --separate-git-dir from unsafe…7.5
• CVE-2026-78678GitPython versions before 3.1.59 contain an incomplete denyl…6.5
• CVE-2026-78679GitPython before 3.1.59 contains an arbitrary file read vuln…6.5
• CVE-2026-7868IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 throu…6.5
• CVE-2026-78680NLTK versions before 3.10.3 fail to use validated absolute p…7.8
• CVE-2026-78681NLTK versions before 3.10.3 use xml.etree.ElementTree to par…7.5
• CVE-2026-78683NLTK before 3.10.0 (affected versions <=3.9.4) contains an u…9.6
• CVE-2026-78684vLLM before 0.27.0 fails to properly classify DeepStream as …5.3
• CVE-2026-78685Medical Practice Management System developed by Le-yan has a…8.8
• CVE-2026-78689Description NGINX JavaScript (njs) has a vulnerability in …8.1
• CVE-2026-7869IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path …5.4
• CVE-2026-78691Improper Neutralization of Special Elements in Data Query Lo…2.1