nltk@2.0.1rc2-git

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the FEATURES regex in nltk/corpus/reader/reviews.py. An attacker can hang ReviewsCorpusReader.reviews(), features(), or sents() by supplying a reviews corpus line made of a long run of words with no trailing bracketed feature annotation. The unbounded feature-label pattern backtracks quadratically on such input, burning CPU in the reader and stalling applications that process untrusted or user-supplied review corpora.

Upgrade nltk to version 3.10.0 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the urlopen process in nltk.pathsec. An attacker can reach loopback or internal HTTP services by supplying a hostname that resolves to a public IP during SSRF validation and to a private IP when urllib makes the actual connection. This defeats nltk.pathsec.ENFORCE and lets nltk.download(server_index_url=...) or nltk.data.load("http://...") fetch and return content from services that the filter was meant to block, including internal admin endpoints and metadata services.

Upgrade nltk to version 3.10.0 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the add_root path handling in nltk/corpus/reader/nkjp.py. An attacker can read files outside the corpus root and bypass the nltk.pathsec sandbox by supplying fileids that contain .. sequences, absolute paths, or symlink escapes to the header, raw, words, sents, or tagged_words read methods. The reader concatenates the caller-controlled fileids into filesystem paths and opens them with the builtin open(), so a crafted path can reach an arbitrary header.xml or other target under attacker-chosen directories on the host. In deployments that rely on ENFORCE=True, this exposes local files that were supposed to be blocked by NLTK’s path validation.

Upgrade nltk to version 3.10.0 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Eval Injection via the __main__ process in collocations.py when command-line arguments are passed directly to the eval function without proper validation or sanitization. An attacker can execute arbitrary Python code, including operating system commands, by supplying crafted command-line arguments.

Upgrade nltk to version 3.9.3 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the Stanford Interface Classes. An attacker can execute arbitrary code by supplying a malicious JAR file to the affected Stanford interface classes, which are invoked without integrity verification.

There is no fixed version for nltk.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the resource_name parameter in the load or find functions. An attacker can access arbitrary files on the system by supplying specially crafted input containing percent-encoded path traversal sequences.

There is no fixed version for nltk.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the nltk.app.wordnet_app module. An attacker can cause the server to shut down and disrupt service availability by sending a specially crafted GET request to the WordNet Browser HTTP server when it is running in its default mode.

Upgrade nltk to version 3.9.4 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the nltk.data.load() function. An attacker can access arbitrary files on the local filesystem by supplying specially crafted URL-encoded path traversal payloads that bypass input validation and are decoded after security checks.

Upgrade nltk to version 3.10.0 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Unsafe Dependency Resolution due to lack of verification or sandboxing in the StanfordSegmenter module, when unvalidated Java Archive (JAR) files are dynamically loaded. An attacker can execute arbitrary Java bytecode by supplying or replacing a JAR file, potentially through model poisoning, Man-in-the-Middle (MITM) attacks, or dependency poisoning.

Upgrade nltk to version 3.9.3 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the JSONTaggedDecoder.decode_obj() function in jsontags.py. An attacker can cause the application to crash by submitting a deeply nested JSON structure that exceeds the recursion limit, resulting in an unhandled exception.

Upgrade nltk to version 3.9.4 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the lookup_... route in the web interface, where attacker-controlled input is reflected into the HTML response without proper escaping. An attacker can execute arbitrary JavaScript in the browser context of the application by convincing a user to open a crafted URL.

Upgrade nltk to version 3.9.4 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the XML index file downloader. An attacker can overwrite arbitrary files and create directories at unintended locations by supplying malicious values for the subdir and id attributes containing path traversal sequences in a remote XML index file.

Upgrade nltk to version 3.9.4 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in WordNet Browser HTTP server in default configuration. An attacker can cause the service to terminate immediately by sending a specially crafted unauthenticated HTTP GET request (e.g. http://127.0.0.1:8004/SHUTDOWN%20THE%20SERVER) to the listening port.

Upgrade nltk to version 3.9.4 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal via the filestring function. An attacker can access sensitive files by supplying specially crafted input paths, such as absolute paths or directory traversal sequences, to bypass input validation and read arbitrary files on the system.

Note:

This is only exploitable if the function processes untrusted user input, such as in web APIs or network-accessible services.

Upgrade nltk to version 3.9.3 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Directory Traversal due to improper sanitization of file paths in the CorpusReader classes. An attacker can gain unauthorized access to sensitive files by supplying crafted file paths to applications that process user-controlled file inputs.

Upgrade nltk to version 3.9.3 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the _unzip_iter() function due to the lack of validation before unpacking untrusted downloaded packages. An attacker can execute arbitrary code by supplying a specially crafted zip file.

Upgrade nltk to version 3.9.3 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) through the integrated data package download functionality. An attacker with control over the NLTK data index can execute arbitrary code by supplying pickled Python code within untrusted packages and trick a user into loading the malicious pickle.

Some packages found to be vulnerable if compromised are averaged_perceptron_tagger, punkt, maxent_ne_chunker, help/tagsets, and maxent_treebank_pos_tagger.

Upgrade nltk to version 3.9 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) in the local WordNet browser. When a user opens a malicious link while the WordNet browser is active, it can result in the exploitation of this vulnerability on their system.

Upgrade nltk to version 3.8.1 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the local Wordnet browser via the MyServerHandler class. Exploiting this vulnerability is possible by creating a maliciously crafted URL.

Note: This only affects users of this browser interface to Wordnet, and not other users of Wordnet.

Upgrade nltk to version 3.8.1 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the RegexpTagger method.

Upgrade nltk to version 3.6.6 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via word_tokenize() in nltk/tokenize/punkt.py.

PoC

from nltk.tokenize import word_tokenize
import nltk
nltk.download('punkt')
import time

for length in [1000*2**n for n in range(1000)]:
    text = "a" * length
    start_t = time.time()
    word_tokenize(text)
    print(f"payload length: {length} takes {time.time()-start_t}s")

Upgrade nltk to version 3.6.6 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the CorpusReader for the Comparative Sentences Dataset.

Upgrade nltk to version 3.6.4 or higher.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). _XML_TAG_NAME regex operator is vulnerable mainly due to the sub-pattern \s*/?\s* and can be exploited with an input such as "<"+" " * 5000

Upgrade nltk to version 3.6 or higher.