CVE-2026-128134

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.4, nltk.parse.dependencygraph.dot2img resolves the Graphviz dot executable through PATH but invokes the resulting absolute executable without routing through spawn_trusted, so resolve_trusted_executable ownership and writability validation and safe_env loader environment scrubbing do not run. A local low-privileged attacker who can write to a directory on a POSIX victim's PATH can plant or replace dot, and code executes as the victim when dot2img is called directly or DependencyGraph.repr_svg renders a graph. The current-working-directory-only bare-name vector is blocked and is not this vulnerability; this issue is the residual writable absolute PATH element bypass after CVE-2026-78680. This issue is fixed in version 3.10.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-13

Last Modified

2026-11-13

Generated

2026-11-14

AI Q&A

2026-11-14

EPSS Evaluated

N/A

NVD

CVE-2026-128134

Affected Vendors & Products

Vendor	Product	Version / Range
nltk	nltk	to 3.10.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

Executive Summary

This vulnerability affects NLTK's nltk.parse.dependencygraph.dot2img function in versions before 3.10.4. It allows a local attacker to replace the Graphviz dot executable in the victim's PATH with a malicious version. When dot2img is called or DependencyGraph.repr_svg renders a graph, the malicious executable runs with the victim's privileges, enabling code execution.

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.4, the system is vulnerable. Inspect PATH directories for unexpected dot executables or writable entries.

Impact Analysis

If you use NLTK versions before 3.10.4, an attacker with local access could execute arbitrary code on your system by replacing the dot executable in your PATH. This could lead to data theft, system compromise, or further network attacks depending on your permissions.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements under GDPR and HIPAA. Organizations using affected NLTK versions may face compliance violations if data is exposed or altered due to exploitation.

Mitigation Strategies

Upgrade NLTK to version 3.10.4 or later using pip install --upgrade nltk. Review and restrict write permissions in PATH directories to prevent malicious dot executables.

Hi! I’m here to help you understand CVE-2026-128134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...