NLTK (Python) – Support, CVEs & Health

GHSA-2ww3-fxvq-293j CVSS_V3

NLTK Vulnerable to REDoS

Published: 2021-09-29 Fixed in: 3.6.4

GHSA-469j-vmhf-r6v7 CVSS_V3

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

Published: 2026-03-19 No fix available

GHSA-68j8-pq59-fqgm CVSS_V3

NLTK has a Path Traversal issue

Published: 2026-03-04 No fix available

GHSA-6hm5-jgcp-p838 CVSS_V3

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Published: 2026-07-31 Fixed in: 3.10.0

GHSA-7p94-766c-hgjp CVSS_V3

NLTK has a Zip Slip Vulnerability

Published: 2026-02-18 Fixed in: 3.9.3

GHSA-848c-c2cx-j7qx CVSS_V3

NLTK vulnerable to Eval Injection via collocations CLI arguments

Published: 2026-07-25 Fixed in: 3.9.3

GHSA-cgvx-9447-vcch CVSS_V3

ntlk unsafe deserialization vulnerability

Published: 2024-06-28 Fixed in: 3.9

GHSA-f8m6-h2c7-8h9x CVSS_V3

Inefficient Regular Expression Complexity in nltk (word_tokenize, sent_tokenize)

Published: 2022-01-06 Fixed in: 3.6.6

GHSA-fg7f-2386-8897 CVSS_V3

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Published: 2026-07-31 Fixed in: 3.10.0

GHSA-gfwx-w7gr-fvh7 CVSS_V3

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

Published: 2026-03-18 Fixed in: 3.9.4

NLTK