GHSA-848c-c2cx-j7qx

Source

https://github.com/advisories/GHSA-848c-c2cx-j7qx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-848c-c2cx-j7qx/GHSA-848c-c2cx-j7qx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-848c-c2cx-j7qx

Aliases

Downstream

ECHO-42f0-e2fb-b0d3

Published

2026-07-25T00:31:47Z

Modified

2026-08-12T19:59:11Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

NLTK vulnerable to Eval Injection via collocations CLI arguments

Details

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.

Database specific

{
    "cwe_ids":  [
        "CWE-95"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-12T19:30:21Z",
    "nvd_published_at":  "2026-07-24T22:16:50Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / nltk

Package

Name: nltk; View open source insights on deps.dev
Purl: pkg:pypi/nltk

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.9.3

Affected versions

2.*

2.0.1rc2-git

2.0b4

2.0b5

2.0b6

2.0b7

2.0b8

2.0b9

2.0.1rc1

2.0.1rc3

2.0.1rc4

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

0.*

0.8

0.9

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

3.*

3.0.0b1

3.0.0b2

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.3

3.4

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.5b1

3.5

3.6

3.6.1

3.6.2

3.6.3

3.6.4

3.6.5

3.6.6

3.6.7

3.7

3.8

3.8.1

3.9b1

3.9

3.9.1

3.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-848c-c2cx-j7qx/GHSA-848c-c2cx-j7qx.json"