Listen to this Post
NLTK’s package downloader in `nltk/downloader.py` does not verify file integrity after download and before extraction. The download flow at lines 789-825 proceeds as follows: the file is downloaded to a temporary path via HTTP, `os.replace(tmp_filepath, filepath)` moves it to the final location at line 799, and then extraction begins via `_unzip_iter()` at line 825. Between steps 2 and 3, there is no SHA-256 verification. The checksum logic exists in `_pkg_status()` at lines 982-1015, but it is only used before download as a status check to determine if a package is already installed and up-to-date. It is never called after download to verify the file that was actually received.
Attack vectors include man-in-the-middle (MITM) during HTTP download, as NLTK downloads from http://` by default on some mirrors; a race condition on shared filesystems where an attacker replaces the file between `os.replace` and_unzip_iter; and DNS poisoning redirecting to an attacker-controlled server. This flaw is a classic integrity-verification weakness (CWE-494) and can lead to remote code execution. The CVSS 4.0 base score is 9.3 (CRITICAL)._unzip_iter()`, comparing it against the expected checksum from the package index, and rejecting and deleting the file if the hash does not match.
This vulnerability is distinct from CVE-2024-39705 (pickle deserialization via download) and CVE-2025-14009 (zip-slip path traversal). Those address what happens after extraction; this finding addresses the gap before extraction where integrity is never verified. The suggested fix is to compute the SHA-256 of the final file after `os.replace()` and before
DailyCVE Form:
Platform: NLTK
Version: < 3.9.3
Vulnerability: Missing Integrity Verification
Severity: CRITICAL (9.3 CVSS)
Date: 2026-08-07
Prediction: Patch expected 2026-08-22
What Undercode Say:
Check installed NLTK version python -c "import nltk; print(nltk.<strong>version</strong>)" Vulnerable versions: < 3.9.3 Fixed version: 3.9.3 and above
PoC: Demonstrating the missing integrity check
import nltk
import unittest.mock
import zipfile
import io
import os
Create a malicious zip that will be "downloaded"
malicious_zip = io.BytesIO()
with zipfile.ZipFile(malicious_zip, 'w') as zf:
zf.writestr('punkt_tab/tokenizers/punkt_tab/english.pickle',
b'MALICIOUS PAYLOAD - attacker controlled content')
Patch urllib to return our malicious zip
with unittest.mock.patch('urllib.request.urlopen') as mock_urlopen:
mock_response = unittest.mock.MagicMock()
mock_response.read.return_value = malicious_zip.getvalue()
mock_response.headers = {'Content-Length': str(len(malicious_zip.getvalue()))}
mock_urlopen.return_value = mock_response
Download proceeds, no integrity check catches the swap
nltk.download('punkt_tab') Would install attacker payload
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by:
- MITM Attack: Intercepting the HTTP download and replacing the legitimate package with a malicious ZIP archive
- DNS Poisoning: Redirecting the NLTK download request to an attacker-controlled server serving a malicious package
- Race Condition: On shared filesystems, replacing the downloaded file between `os.replace()` and `_unzip_iter()`
The malicious ZIP is then extracted without any integrity validation, allowing attacker-controlled corpus or model content to be trusted by downstream users and applications.
Protection:
- Upgrade NLTK to version 3.9.3 or later
- For Debian users, fixed version is available in `unstable` (3.9.3-1)
- The fix in NLTK 3.10.0 introduces SHA-256 checksum validation before extraction
- If upgrading is not possible, manually verify downloaded package checksums before extraction
- Use HTTPS mirrors instead of HTTP when available
Impact:
Successful exploitation allows an attacker to:
- Inject malicious code or data into NLTK’s downloaded packages
- Achieve remote code execution through crafted package contents
- Compromise the integrity of NLP pipelines and downstream applications relying on NLTK corpora and models
- Execute arbitrary code with the privileges of the user running NLTK
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
