CVE-2026-12259

In nltk version 3.9.4, the "nltk.downloader.Downloader.downloadpackage" function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for "info.url" through a compromised...

CVE-2026-12259: Download of Code Without Integrity Check

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...