CVE-2026-63310
Received Received - Intake

NLTK Package Integrity Flaw Before Extraction

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-63310
EUVD
EUVD-2026-64335

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nltk nltk to 3.9.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63310 affects NLTK versions before 3.9.3 due to missing integrity verification after downloading packages. Attackers can exploit this by performing man-in-the-middle attacks or DNS poisoning to inject malicious content during download. The downloaded files are moved to their final location and extracted without checking for tampering, allowing harmful code to be installed unnoticed.

Detection Guidance

To detect this vulnerability, check if your NLTK version is below 3.9.3. Run: pip show nltk. If the version is older, the system is vulnerable. Monitor network traffic for unusual downloads or extraction activities in nltk/downloader.py. Check for unexpected file modifications in NLTK package directories.

Impact Analysis

This vulnerability allows attackers to replace legitimate NLTK packages with malicious ones during download. If exploited, it could lead to arbitrary code execution, data breaches, or system compromise. Users of affected NLTK versions risk installing harmful software without their knowledge.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized code execution or data exfiltration. Failure to ensure software integrity may result in non-compliance with data protection and security standards.

Mitigation Strategies

Upgrade NLTK to version 3.9.3 or later immediately using: pip install --upgrade nltk. Verify the integrity of existing NLTK packages by checking their SHA-256 checksums against known good values. Disable automatic package downloads if not required. Monitor for suspicious activity in NLTK package directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart