CVE-2026-12259

creationtimestamp| type| source ---|---|--- 2026-09-08 16:35:07+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-5wp5-5229-5g6q 2026-09-08 20:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muzugs7i6b24...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259 Improper Input Validation in nltk/nltk

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...