Code Execution in NLTK via Untrusted JAR in Stanford Interfaces

Executive Summary

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution.

These classes accept user-controllable JAR file paths and execute them using the java() function, which internally calls subprocess.Popen() without verifying the integrity of the JAR files.

Because there is no integrity verification, an attacker can supply a malicious JAR file that will be executed, leading to arbitrary code execution.

This vulnerability is similar to CVE-2026-0848, which was fixed for the StanfordSegmenter by adding SHA256 verification, but this fix was not applied to these five classes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution on the system running the vulnerable nltk classes if an attacker can supply a malicious JAR file.

Because the vulnerability allows execution of untrusted code with potentially high privileges, it can compromise confidentiality, integrity, and availability of the affected system.

The CVSS v3.0 base score of 7.8 reflects a high severity, indicating significant impact including possible data loss, system compromise, or denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid using untrusted JAR files with the affected Stanford interface classes in nltk versions 3.9.3 and earlier.

Since the fix applied to StanfordSegmenter (SHA256 verification of JAR files) was not applied to these classes, you should manually verify the integrity of any JAR files before use.

Alternatively, upgrade to a version of nltk where this vulnerability is fixed or apply similar integrity verification (e.g., SHA256 checksum) to the JAR files used by these classes.

Useful 0 Not Useful 0