Arbitrary Argument Injection

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Arbitrary Argument Injection through the per-call options handling in the java function in nltk/internals.py. An attacker can achieve arbitrary...

CVE-2026-79675: Improper Neutralization of Argument Delimiters in a Command

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...