PatchTheCVEnltk vulnerabilities and fixes
Recent CVEs affecting nltk, with upgrade or downgrade steps. 3 tracked.
nltk has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-08-09. Highest priority: CVE-2026-12261 (score 25/100).
- CVE-2026-12259 MEDIUM 6.5 DOWNGRADE In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package
- CVE-2026-12261 MEDIUM 6.5 UPGRADE A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and mode
- CVE-2026-12372 LOW 3.7 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop
FAQ
How do I fix nltk vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nltk being exploited right now?
None of the tracked nltk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nltk CVE should I patch first?
CVE-2026-12261 currently ranks highest (25/100): A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and mode.