NLTK (Python) – Support, CVEs & Health

GHSA-2jhm-w3mp-jcwr CVSS_V3

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

Published: 2026-08-10 Fixed in: 3.10.0

GHSA-2ww3-fxvq-293j CVSS_V3

NLTK Vulnerable to REDoS

Published: 2021-09-29 Fixed in: 3.6.4

GHSA-3gq4-3j92-5w49 CVSS_V4

NLTK: Corpus Reader Sandbox Bypass

Published: 2026-09-08 Fixed in: 3.10.3

GHSA-3gqm-fcw5-w839 CVSS_V4

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

Published: 2026-09-02 Fixed in: 3.10.0

GHSA-3hhw-38pf-pxj6 CVSS_V3

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Published: 2026-09-08 Fixed in: 3.10.2

GHSA-469j-vmhf-r6v7 CVSS_V3

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

Published: 2026-03-19 No fix available

GHSA-568f-pv23-39p4 CVSS_V3

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Published: 2026-09-08 Fixed in: 3.10.0

GHSA-5gh2-94qg-qppq CVSS_V3

NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

Published: 2026-08-22 Fixed in: 3.10.3

GHSA-5wp5-5229-5g6q CVSS_V3

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

Published: 2026-09-08 Fixed in: 3.9.3

GHSA-68j8-pq59-fqgm CVSS_V3

NLTK has a Path Traversal issue

Published: 2026-03-04 No fix available

NLTK