CVE-2026-33230

🗓️ 20 Mar 2026 22:43:39Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 14 Views🌐 WEB

Reflected cross-site scripting in the Natural Language Toolkit WordNet app enables HTML injection via crafted payloads.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a missing authentication and cross-site Scripting in NLTK [CVE-2026-33230, CVE-2026-33231]	21 May 202614:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	19 May 202605:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to XSS (CVE-2026-33230), denial of service (CVE-2026-33231, GHSA-rf74-v2fm-23pw) and path traversal (CVE-2026-33236)	26 Mar 202616:02	–	ibm
ATTACKERKB	CVE-2026-33230	20 Mar 202622:43	–	attackerkb
Chainguard	CVE-2026-33230 vulnerabilities	26 Mar 202601:17	–	cgr
Circl	CVE-2026-33230	18 Mar 202611:48	–	circl
CNNVD	NLTK 跨站脚本漏洞	20 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33230 nltk Vulnerable to Cross-site Scripting	20 Mar 202622:43	–	cvelist
Debian CVE	CVE-2026-33230	20 Mar 202622:43	–	debiancve
Github Security Blog	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk	18 Mar 202620:23	–	github

NVD

Vulners

Node

nltk nltkRange≤3.9.3

[
  {
    "vendor": "nltk",
    "product": "nltk",
    "versions": [
      {
        "version": "<= 3.9.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
github	www.github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
github	www.github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7

Parameter	Position	Path	Description	CWE
word	path	/lookup_<payload>	Reflected cross-site scripting via the lookup_<payload> route in nltk.app.wordnet_app; attacker-controlled word data is reflected into the HTML without escaping.	CWE-79

23 Mar 2026 19:14Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.1

EPSS0.00331

SSVC

CWE-79