CVE catalog

CVE-2025-14009

NLTK vulnerability

[CVE catalog]

Severity
Critical · CVSS 10
Published
Source
[NVD] · [CVE record]
EPSS
1.04% · Oct 25, 2026

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannltksid3.10.3-1fixed
Debiannltkforky3.10.3-1fixed
Debiannltktrixie3.9.1-2vulnerable
Debiannltkbookworm3.8-1vulnerable
UbuntunltknobleNot reportedvulnerable
PyPInltkNot reportedNot reportedunknown
Ubuntunltknoble3.8.1-1ubuntu0.1~esm1fixed
Ubuntupython3-nltknoble3.8.1-1ubuntu0.1~esm1fixed
Ubuntunltkpro3.9.1-2vulnerable
Ubuntunltkpro3.9.1-2build1vulnerable
Ubuntunltkpro3.9.2-1vulnerable
Ubuntunltkpro3.9.2-1ubuntu0.1~esm1fixed
Opensusepython-nltktumbleweed3.9.1-3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannltksourcesid3.9.3-1not yet assignedNot reported[1128474]
Debiannltksourceforky3.9.3-1not yet assignedNot reported[1128474]
Debiannltksourcetrixie(unfixed)not yet assignedNot reported[1128474]
Debiannltksourcebookworm(unfixed)not yet assignedNot reported[1128474]
Ubuntunltkdebnoble3.8.1-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntupython3-nltkdebnoble3.8.1-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Ubuntunltkdebpro3.9.2-1ubuntu0.1~esm1Not reportedUSN-8214-1Not reported
Opensusepython-nltkrpmtumbleweed3.9.1-3.1Not reportedOPENSUSE-SU-2026:10226-1Not reported

[Debian bug #1128474]

Notes

[trixie] nltk: Minor issue [bookworm] nltk: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-nltk]Affected

    Source package: [nltk]

    Details (2)

    • 3.8-1 · all · bookworm

      Affected

      usn · nltk · debian · bookworm; usn · nltk · debian · 12

    • 3.8-1 · all · bookworm

      Affected

      usn · nltk · debian · bookworm; usn · nltk · debian · 12

[Debian 13 (Trixie)]

  • [python3-nltk]Affected

    Source package: [nltk]

    Details (2)

    • 3.9.1-2 · all · trixie

      Affected

      usn · nltk · debian · 13

    • 3.9.1-2 · all · trixie

      Affected

      usn · nltk · debian · 13

[openSUSE Tumbleweed]

  • [python313-nltk]Unknown

    Source package: [python-nltk]

    Details (1)

    • 3.10.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.9.1-3.1

      Version impact unknown

      usn · python-nltk · opensuse · tumbleweed

  • [python314-nltk]Unknown

    Source package: [python-nltk]

    Details (1)

    • 3.10.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.9.1-3.1

      Version impact unknown

      usn · python-nltk · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]