The vulnerability of the nltk.download() function in the Natural Language Toolkit (NLTK) library, which is used for symbolic and statistical processing of natural language, allows a hacker to execute arbitrary code.

🗓️ 16 Sep 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

NLTK download vulnerability enables remote code execution via memory data during tagger and Punkt.

Reporter	Title	Published	Views	Family All 44
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Natural Language Toolkit (NLTK) affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	17 Mar 202514:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Ai-Broker Component component uses nltk-3.8.1-py3-none-any.whl which is vulnerable to this CVE-2024-39705	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	4 Feb 202518:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities affecting IBM Knowledge Catalog for IBM Cloud Pak for Data	1 Jun 202523:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Watson NLP affect IBM Robotic Process Automation	17 Oct 202400:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Natural Language Toolkit (NLTK)( CVE-2024-39705) affects IBM watsonx Assistant for IBM Cloud Pak for Data	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Natural Language Toolkit (NLTK)	26 Feb 202518:42	–	ibm
Chainguard	CVE-2024-39705 vulnerabilities	27 Jun 202422:15	–	cgr

Vulners

Node

nltk nltkRange≤3.8.1

Source	Link
github	www.github.com/nltk/nltk/issues/2522
github	www.github.com/nltk/nltk/issues/3266
vicarius	www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
github	www.github.com/advisories/GHSA-cgvx-9447-vcch
nltk	www.nltk.org/news.html
web	www.web.nvd.nist.gov/view/vuln/detail

16 Sep 2024 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 39.8

CVSS 210

EPSS0.01346

natural language toolkit download vulnerability remote code execution memory data handling averaged perceptron tagger punkt package