nltk@3.10.2

Natural Language Toolkit

latest version

3.10.3

first published

17 years ago

latest version published

7 days ago

licenses detected

Apache-2.0
[2.0b4,)

View nltk package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the nltk package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Time-of-check Time-of-use (TOCTOU) Race Condition nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing. Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the `downloader` process. An attacker can compromise data integrity by causing package archives to be extracted into shared namespaces before integrity validation, which may overwrite trusted resources in machine learning pipelines and environments sensitive to reproducibility. This is only exploitable if a user interacts with the downloader and downloads a malicious package. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? There is no fixed version for `nltk`.	[0,)
H Improper Verification of Cryptographic Signature nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the Stanford Interface Classes. An attacker can execute arbitrary code by supplying a malicious JAR file to the affected Stanford interface classes, which are invoked without integrity verification. How to fix Improper Verification of Cryptographic Signature? There is no fixed version for `nltk`.	[0,)

Time-of-check Time-of-use (TOCTOU) Race Condition

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the downloader process. An attacker can compromise data integrity by causing package archives to be extracted into shared namespaces before integrity validation, which may overwrite trusted resources in machine learning pipelines and environments sensitive to reproducibility. This is only exploitable if a user interacts with the downloader and downloads a malicious package.

How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

There is no fixed version for nltk.

[0,)

Improper Verification of Cryptographic Signature

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the Stanford Interface Classes. An attacker can execute arbitrary code by supplying a malicious JAR file to the affected Stanford interface classes, which are invoked without integrity verification.

How to fix Improper Verification of Cryptographic Signature?

There is no fixed version for nltk.

[0,)

Go back to all versions of this package