Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-78680

NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nltk nltk

Default version status: unaffected

  • 0 to < 3.10.3affected
  • 3.10.3unaffected
pkg:pypi/nltk

References