Snyk Security Database

Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue(), peg$parsearray(), and peg$parseinline_table_entry() functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process with a RangeError: Maximum call stack size exceeded by supplying a deeply nested TOML document, such as a ~6 KB payload nested about 2,500 levels (a=[[[...]]]). This requires the application to call toml.parse() on untrusted input, and error handlers that catch only SyntaxError do not contain the resulting RangeError, which is not a SyntaxError subclass.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in nltk/downloader.py through the Downloader._download_package() download-and-extract flow. An attacker can install malicious package contents by tampering with the archive response, such as through a compromised mirror, HTTP interception, or a substituted download source. The downloader writes the fetched package to disk and then proceeds to extract it without verifying the final file against the expected checksum, so a modified archive can be unpacked as if it were trusted. This can lead to attacker-controlled corpus or model files being installed on systems that use nltk.download().

Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue(), peg$parsearray(), and peg$parseinline_table_entry() functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process with a RangeError: Maximum call stack size exceeded by supplying a deeply nested TOML document, such as a ~6 KB payload nested about 2,500 levels (a=[[[...]]]). This requires the application to call toml.parse() on untrusted input, and error handlers that catch only SyntaxError do not contain the resulting RangeError, which is not a SyntaxError subclass.