UBUNTU-CVE-2026-12261

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-12261

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-12261

Upstream

CVE-2026-12261

Published

2026-08-07T00:00:00Z

Modified

2026-08-07T17:45:11.240383980Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A vulnerability in nltk.downloader in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

References

Affected packages

Ubuntu:Pro:14.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0~b9-0ubuntu4

2.0~b9-0ubuntu4.1~esm2

2.0~b9-0ubuntu4.1~esm4

2.0~b9-0ubuntu4.1~esm5

2.0~b9-0ubuntu4.1~esm6

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.0~b9-0ubuntu4.1~esm6",
            "binary_name": "python-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"

Ubuntu:Pro:16.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.4-1

3.0.5-1

3.1-1

3.1-1ubuntu0.1

3.1-1ubuntu0.1+esm1

3.1-1ubuntu0.1+esm2

3.1-1ubuntu0.1+esm3

3.1-1ubuntu0.1+esm4

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.1-1ubuntu0.1+esm4",
            "binary_name": "python-nltk"
        },
        {
            "binary_version": "3.1-1ubuntu0.1+esm4",
            "binary_name": "python3-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"

Ubuntu:Pro:18.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.4-1

3.2.5-1

3.2.5-1ubuntu0.1

3.2.5-1ubuntu0.1+esm1

3.2.5-1ubuntu0.1+esm2

3.2.5-1ubuntu0.1+esm3

3.2.5-1ubuntu0.1+esm4

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.2.5-1ubuntu0.1+esm4",
            "binary_name": "python-nltk"
        },
        {
            "binary_version": "3.2.5-1ubuntu0.1+esm4",
            "binary_name": "python3-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"

Ubuntu:Pro:20.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.4.5-1

3.4.5-2

3.4.5-2ubuntu0.1~esm1

3.4.5-2ubuntu0.1~esm2

3.4.5-2ubuntu0.1~esm3

3.4.5-2ubuntu0.1~esm4

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.4.5-2ubuntu0.1~esm4",
            "binary_name": "python3-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"

Ubuntu:Pro:22.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.5-1

3.6.5-1

3.6.7-1

3.7-1

3.7-1ubuntu0.1~esm1

3.7-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.7-1ubuntu0.1~esm2",
            "binary_name": "python3-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"

Ubuntu:Pro:24.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.8.1-1

3.8.1-1ubuntu0.1~esm1

3.8.1-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.8.1-1ubuntu0.1~esm2",
            "binary_name": "python3-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"

Ubuntu:Pro:26.04:LTS

nltk

Package

Name: nltk
Purl: pkg:deb/ubuntu/nltk?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.9.1-2

3.9.1-2build1

3.9.2-1

3.9.2-1ubuntu0.1~esm1

3.9.2-1ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.9.2-1ubuntu0.1~esm2",
            "binary_name": "python3-nltk"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-12261.json"