CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function. Attackers can inject dangerous JVM flags such as -agentpath , -javaagent , or @argfile into Stanford wrapper classes, achieving arbitrary code execution . The vulnerability is ra...