NLTK Java Option Injection Vulnerability

Executive Summary

CVE-2026-79675 is a vulnerability in NLTK before 3.10.3 where the java() function fails to validate JVM options passed through the per-call options parameter. Attackers can inject malicious flags like -agentpath or -javaagent into Stanford wrapper classes, bypassing previous fixes and achieving arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect NLTK installations for versions before 3.10.3. Check for usage of affected Stanford wrapper classes with user-supplied java_options parameters. Review logs for suspicious JVM flags like -agentpath, -javaagent, or @argfile in subprocess.Popen calls.

Useful 0 Not Useful 0

Impact Analysis

If you use NLTK with Stanford wrappers in a service accepting user input, an attacker could exploit this to execute arbitrary code on your system. This could lead to data theft, system compromise, or further network infiltration depending on your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating GDPR's integrity principle or HIPAA's security rule by exposing sensitive data. Compliance may be impacted if the breach results in data loss or unauthorized access to protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later. Review and sanitize all java_options inputs in Stanford wrapper classes. Implement strict validation for JVM options before passing them to subprocess.Popen.

Useful 0 Not Useful 0