https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 02 Sep 2026 11:42:26 +0000 https://vulnerability.circl.lu/sighting/7b83c6ad-8a69-48af-b384-e996a7149f24/export {"uuid": "7b83c6ad-8a69-48af-b384-e996a7149f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12841", "type": "seen", "source": "https://gist.github.com/alon710/d77c44365a5d967f73ae86db10f23480", "content": "# CVE-2026-79675: CVE-2026-79675: JVM Argument Injection in Natural Language Toolkit (NLTK) Stanford Wrappers\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-79675\n\n## Summary\nCVE-2026-79675 is a critical command injection vulnerability in NLTK versions prior to 3.10.3 that permits remote attackers to execute arbitrary code on the hosting system. This vulnerability stems from an incomplete mitigation of a previous vulnerability, CVE-2026-12841. While NLTK verified global JVM options configured through the library's setup routines, it failed to perform equivalent safety checks on options provided during per-call invocations of Stanford NLP Java wrappers. Attackers controlling these parameters can pass dangerous Java configuration options to the system shell, bypassing security boundaries to spawn interactive processes or load untrusted Java archives.\n\n## TL;DR\nAn input validation bypass in NLTK's Stanford Java interface allows remote attackers to inject arbitrary JVM command-line options, such as -XX:OnError, to execute system commands and achieve unauthenticated remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00403 (Percentile: 33.49%)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- NLTK (Natural Language Toolkit) versions prior to 3.10.3\n- **NLTK (Natural Language Toolkit)**: < 3.10.3 (Fixed in: `3.10.3`)\n\n## Mitigation\n\n- Upgrade NLTK to version 3.10.3 or higher.\n- Sanitize application parameters to prevent untrusted inputs from reaching the options configuration in NLTK wrappers.\n- Run the application process with reduced OS-level privileges to limit the impact of command execution.\n\n**Remediation Steps:**\n1. Execute the update utility: pip install --upgrade nltk>=3.10.3\n2. Audit existing codebase for usage of StanfordParser, StanfordTokenizer, StanfordPOSTagger, or StanfordSegmenter.\n3. Verify that no client-controlled parameters map directly or indirectly to the java_options argument of these wrapper objects.\n4. Ensure that any usage of the new trusted_raw_options parameter is strictly configured with static, developer-defined strings.\n\n## References\n\n- [NLTK Security Advisory](https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-79675) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T21:31:43.187048Z"} {"uuid": "7b83c6ad-8a69-48af-b384-e996a7149f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12841", "type": "seen", "source": "https://gist.github.com/alon710/d77c44365a5d967f73ae86db10f23480", "content": "# CVE-2026-79675: CVE-2026-79675: JVM Argument Injection in Natural Language Toolkit (NLTK) Stanford Wrappers\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-79675\n\n## Summary\nCVE-2026-79675 is a critical command injection vulnerability in NLTK versions prior to 3.10.3 that permits remote attackers to execute arbitrary code on the hosting system. This vulnerability stems from an incomplete mitigation of a previous vulnerability, CVE-2026-12841. While NLTK verified global JVM options configured through the library's setup routines, it failed to perform equivalent safety checks on options provided during per-call invocations of Stanford NLP Java wrappers. Attackers controlling these parameters can pass dangerous Java configuration options to the system shell, bypassing security boundaries to spawn interactive processes or load untrusted Java archives.\n\n## TL;DR\nAn input validation bypass in NLTK's Stanford Java interface allows remote attackers to inject arbitrary JVM command-line options, such as -XX:OnError, to execute system commands and achieve unauthenticated remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00403 (Percentile: 33.49%)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- NLTK (Natural Language Toolkit) versions prior to 3.10.3\n- **NLTK (Natural Language Toolkit)**: < 3.10.3 (Fixed in: `3.10.3`)\n\n## Mitigation\n\n- Upgrade NLTK to version 3.10.3 or higher.\n- Sanitize application parameters to prevent untrusted inputs from reaching the options configuration in NLTK wrappers.\n- Run the application process with reduced OS-level privileges to limit the impact of command execution.\n\n**Remediation Steps:**\n1. Execute the update utility: pip install --upgrade nltk>=3.10.3\n2. Audit existing codebase for usage of StanfordParser, StanfordTokenizer, StanfordPOSTagger, or StanfordSegmenter.\n3. Verify that no client-controlled parameters map directly or indirectly to the java_options argument of these wrapper objects.\n4. Ensure that any usage of the new trusted_raw_options parameter is strictly configured with static, developer-defined strings.\n\n## References\n\n- [NLTK Security Advisory](https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-79675) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T21:31:43.187048Z"} https://vulnerability.circl.lu/sighting/7b83c6ad-8a69-48af-b384-e996a7149f24/export Tue, 01 Sep 2026 21:31:43 +0000