NLTK Path Traversal Allows Arbitrary Code Execution

Executive Summary

NLTK versions before 3.10.3 are vulnerable to arbitrary code execution due to improper handling of the Graphviz dot binary. The library fails to use validated absolute paths when invoking the dot binary in two functions, allowing attackers to place a malicious dot binary in the search path or current working directory. On Windows, this can be done via the current working directory, while on Unix-like systems, attackers can manipulate relative PATH entries.

Useful 0 Not Useful 0

Detection Guidance

Check NLTK version with pip show nltk. If version is below 3.10.3, the system is vulnerable. Inspect directories in PATH for unexpected dot binaries. On Unix, run which dot to verify the binary location. On Windows, check current directory and PATH entries for suspicious dot.exe files.

Useful 0 Not Useful 0

Impact Analysis

If you use NLTK versions before 3.10.3, an attacker could execute arbitrary code on your system by tricking the library into running a malicious dot binary instead of the legitimate Graphviz tool. This could lead to unauthorized access, data theft, or further compromise of your system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches or loss of sensitive information. Such incidents may violate compliance requirements under GDPR, HIPAA, or other regulations, leading to legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later using pip install --upgrade nltk. Remove any untrusted dot binaries from current directory and PATH. Avoid running NLTK functions in untrusted directories until patched.

Useful 0 Not Useful 0