CVE-2025-14009 vulnerabilities

Vulnerabilities for packages: nemo, open-webui, kubeflow-pipelines-visualization-server, py3-nltk, label-studio, apache-beam-python-3.11-sdk...

CVE-2025-14009

A code execution vector has been discovered in the python NTLK library. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, ca...

CVE-2025-14009

creationtimestamp| type| source ---|---|--- 2026-02-18 18:32:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mf5pnybld22m 2026-02-18 19:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5rababgq2h 2026-08-05 12:38:05+00:00| seen|...

CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...