CVE-2026-33236: NLTK Downloader Path Traversal Vulnerability Leading to Arbitrary File Overwrite
Summary
CVE-2026-33236: NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite. Affects nltk versions < 3.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NLTK (Natural Language Toolkit) is a powerful library in Python used for working with human language data (text). It provides easy-to-use interfaces to over 50 corpora and lexical resources, along with a suite of text processing libraries for classification, tokenization, stemming, tagging, parsing, and more. However, the NLTK downloader has a critical vulnerability that allows attackers to exploit path traversal sequences, potentially leading to unauthorized file access and manipulation.
Vulnerability Detail
The NLTK downloader does not validate the 'subdir' and 'id' attributes when processing remote XML index files. This oversight allows attackers to control a remote XML index server to provide malicious values that can include path traversal sequences (e.g., '../'). As a result, attackers can create arbitrary directories, create arbitrary files, and overwrite critical system files, such as '/etc/passwd' or '~/.ssh/authorized_keys'. The vulnerability arises from the lack of validation in XML parsing and path construction, enabling an attack chain that can compromise system integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the NLTK downloader to fetch packages from untrusted sources. If you must use it, ensure that the XML index server is controlled and trusted. Additionally, consider implementing file system permissions that restrict write access to sensitive directories.
Conclusion
The NLTK downloader vulnerability (CVE-2026-33236) poses a significant risk due to its potential for arbitrary file overwrite through path traversal. It is crucial for users to update to the latest version of NLTK and to implement best practices for security to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for nltk →
FAQ
CVE-2026-33236 is a vulnerability in the NLTK downloader that allows for path traversal, leading to arbitrary file overwrite.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The vulnerability can lead to unauthorized file creation and overwriting of critical system files, which may compromise system security and integrity.
You can update NLTK by running 'pip install --upgrade nltk' in your terminal to ensure you have the latest patched version.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
