CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

PT-2026-81155

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Failure to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent. repr svg allows for arbitrary code execution. Attackers can exploit bare-name...