CVE-2026-12259

Published: Ago 03, 2026 Last Modified: Ago 03, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.

494

Download of Code Without Integrity Check

Draft
Common Consequences
Security Scopes Affected:
Integrity Availability Confidentiality Other
Potential Impacts:
Execute Unauthorized Code Or Commands Alter Execution Logic Other
Applicable Platforms
All platforms may be affected
View CWE Details
https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633c35a5d