GHSA-M4RF-3FR8-XWX3 NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...

NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...

Linux Distros Unpatched Vulnerability : CVE-2026-79675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM...

Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function,...

GHSA-3H2G-J4WP-7QQQ Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function,...

CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function. Attackers can inject dangerous JVM flags such as -agentpath , -javaagent , or @argfile into Stanford wrapper classes, achieving arbitrary code execution . The vulnerability is ra...

CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...