https://vulnerability.circl.lu/sightings/feed 2026-09-02T11:02:16.400608+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0200f4cc-d2fd-4192-a2a8-6cd22d4a231a/export 2026-09-02T11:02:16.431738+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0200f4cc-d2fd-4192-a2a8-6cd22d4a231a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://gist.github.com/alon710/d77c44365a5d967f73ae86db10f23480", "content": "# CVE-2026-79675: CVE-2026-79675: JVM Argument Injection in Natural Language Toolkit (NLTK) Stanford Wrappers\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-79675\n\n## Summary\nCVE-2026-79675 is a critical command injection vulnerability in NLTK versions prior to 3.10.3 that permits remote attackers to execute arbitrary code on the hosting system. This vulnerability stems from an incomplete mitigation of a previous vulnerability, CVE-2026-12841. While NLTK verified global JVM options configured through the library's setup routines, it failed to perform equivalent safety checks on options provided during per-call invocations of Stanford NLP Java wrappers. Attackers controlling these parameters can pass dangerous Java configuration options to the system shell, bypassing security boundaries to spawn interactive processes or load untrusted Java archives.\n\n## TL;DR\nAn input validation bypass in NLTK's Stanford Java interface allows remote attackers to inject arbitrary JVM command-line options, such as -XX:OnError, to execute system commands and achieve unauthenticated remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00403 (Percentile: 33.49%)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- NLTK (Natural Language Toolkit) versions prior to 3.10.3\n- **NLTK (Natural Language Toolkit)**: < 3.10.3 (Fixed in: `3.10.3`)\n\n## Mitigation\n\n- Upgrade NLTK to version 3.10.3 or higher.\n- Sanitize application parameters to prevent untrusted inputs from reaching the options configuration in NLTK wrappers.\n- Run the application process with reduced OS-level privileges to limit the impact of command execution.\n\n**Remediation Steps:**\n1. Execute the update utility: pip install --upgrade nltk>=3.10.3\n2. Audit existing codebase for usage of StanfordParser, StanfordTokenizer, StanfordPOSTagger, or StanfordSegmenter.\n3. Verify that no client-controlled parameters map directly or indirectly to the java_options argument of these wrapper objects.\n4. Ensure that any usage of the new trusted_raw_options parameter is strictly configured with static, developer-defined strings.\n\n## References\n\n- [NLTK Security Advisory](https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-79675) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T21:31:43.242912Z"} 2026-09-01T21:31:43.242912+00:00 https://vulnerability.circl.lu/sighting/866c4d07-41c8-4d53-8d99-b09a9dd14eac/export 2026-09-02T11:02:16.435656+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "866c4d07-41c8-4d53-8d99-b09a9dd14eac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu3s6zgslc2f", "content": "CVE-2026-79675 - nltk\nVersions of the NLTK Python library older than 3.10.3 do not check the extra Java settings that can be supplied to its java() helper. An attacker who can influence those settings\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nltk #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-27T21:30:04.160297Z"} 2026-08-27T21:30:04.160297+00:00 https://vulnerability.circl.lu/sighting/084622ef-8a18-4838-89fb-5ea826aa91a8/export 2026-09-02T11:02:16.435849+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "084622ef-8a18-4838-89fb-5ea826aa91a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwv6e4khx2u", "content": "CVE-2026-79675 - nltk\nVersions of the NLTK Python library before the latest release let attackers add dangerous Java settings when calling its java() function. This can let an attacker run arbitrary code on the system.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nltk #CVE #infosec", "creation_timestamp": "2026-08-25T22:40:04.523073Z"} 2026-08-25T22:40:04.523073+00:00 https://vulnerability.circl.lu/sighting/c985d7d0-f747-4219-a179-dd8f1bd0a013/export 2026-09-02T11:02:16.436006+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c985d7d0-f747-4219-a179-dd8f1bd0a013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtwfz2x7pl2e", "content": "\ud83d\udea8 CVE-2026-79675 \u2014 CVSS 9.3 CRITICAL\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java(...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-79675\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T18:08:40.661425Z"} 2026-08-25T18:08:40.661425+00:00 https://vulnerability.circl.lu/sighting/bcba8dac-4fae-45b2-a8a6-5c7174f67859/export 2026-09-02T11:02:16.436144+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "bcba8dac-4fae-45b2-a8a6-5c7174f67859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwc7qg74h2u", "content": "\ud83d\udd34 CVE-2026-79675 - Critical (9.8)\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-79675/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-25T17:00:50.364075Z"} 2026-08-25T17:00:50.364075+00:00