ZeroDay Findings
Sign inSign up

Findings

Vulnerability · CVE-2026-12259

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

Published Aug 3, 2026 · corrected/updated Oct 16, 2026 · nltk nltk · evidence confidence high

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replace(tmp_filepath, filepath) moves it to the final location (line 799) 3. Extraction begins via _unzip_iter() (line 825) Between steps 2 and 3, there is no SHA-256 verification. The checksum logic exists in _pkg_status() (lines 982-1015) but it is only used BEFORE download as a status check ("is this package already installed and up-to-date?"). It is never called after download to verify the file that was actually received. Attack vectors: 1. MITM during HTTP download (NLTK downloads from http:// by default on some mirrors) 2. Race condition on shared filesystems (attacker replaces file between os.replace and _unzip_iter) 3. DNS poisoning redirecting to attacker-controlled server PoC: This is distinct from CVE-2024-39705 (pickle deserialization via download) and CVE-2025-14009 (zip-slip path traversal). Those address what happens AFTER extraction. This finding addresses the gap BEFORE extraction where integrity is never verified. Suggested fix: After os.replace() and before _unzip_iter(), compute SHA-256 of the final file and compare against the expected checksum from the package index. Reject and delete the file if the hash does not match.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-12259 is a high public vulnerability record for nltk nltk. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether nltk nltk is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: nltk (0 → 3.9.2); nltk (0 → 3.9.3); nltk (0 → 3.9.4); nltk (0.8, 0.9, 0.9.3). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 7.1, EPSS 0.1%. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-494. Sources contributing to this record: cve_org, epss, github, github. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 3, 2026 · NIST NVD

    Detected

    In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result

  2. Sep 9, 2026 · GitHub Advisory Database

    Withdrawn

    The advisory was withdrawn.

  3. Oct 15, 2026 · NIST NVD

    Updated

    In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result

  4. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    nltk fixed in 3.9.3

  5. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    nltk fixed in 3.9.3

  6. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    nltk fixed in 3.9.4

  7. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    nltk fixed in 3.9.2

  8. Oct 16, 2026 · GitHub Advisory Database

    Updated

    NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replace(tmp_filepath, filepath) moves it to the final location (line 799) 3. Extraction begins via _unzip_iter() (line 825) Between steps 2 and 3, there is no SHA-256 verification. The checksum l

Affected

  • PyPI nltk0 → 3.9.2
  • PyPI nltk0 → 3.9.3
  • PyPI nltk0 → 3.9.4
  • PyPI nltk0.8, 0.9, 0.9.3
  • cpe nltk/nltk3.9.4

Sources

  • CVE.orgVulnerability recordCVE-2026-12259

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-12259

    30-day exploitation probability 0.1%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-5wp5-5229-5g6q

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitHub Advisory DatabasePackage advisoryGHSA-gf32-cmjh-8m9v

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-12259

    In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for t

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-5wp5-5229-5g6q

    NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-gf32-cmjh-8m9v

    Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryPYSEC-2026-3729
    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryPYSEC-2026-4318
    osv.dev
  • PyPA Advisory DatabasePackage advisoryGHSA-5wp5-5229-5g6q

    NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

    osv.dev
  • PyPA Advisory DatabasePackage advisoryGHSA-gf32-cmjh-8m9v

    Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

    osv.dev
  • PyPA Advisory DatabasePackage advisoryPYSEC-2026-3729

    NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

    osv.dev
  • PyPA Advisory DatabasePackage advisoryPYSEC-2026-4318

    In nltk version 3.9.4, the function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for through a compromised mirror, malicious proxy, or other sourc

    osv.dev

References