id: PYSEC-2026-2237
published: "2026-03-20T23:16:47.007Z"
modified: "2026-07-13T05:50:16.781467Z"
aliases:
- CVE-2026-33236
- GHSA-469j-vmhf-r6v7
details: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the `subdir` and `id` attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences (such as `../`), which can lead to arbitrary directory creation, arbitrary file creation, and arbitrary file overwrite. Commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a patches the issue.
affected:
- package:
    name: nltk
    ecosystem: PyPI
    purl: pkg:pypi/nltk
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.9.4
  versions:
  - "0.8"
  - "0.9"
  - 0.9.3
  - 0.9.4
  - 0.9.5
  - 0.9.6
  - 0.9.7
  - 0.9.8
  - 0.9.9
  - 2.0.1
  - 2.0.1rc1
  - 2.0.1rc2-git
  - 2.0.1rc3
  - 2.0.1rc4
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0b4
  - 2.0b5
  - 2.0b6
  - 2.0b7
  - 2.0b8
  - 2.0b9
  - 3.0.0
  - 3.0.0b1
  - 3.0.0b2
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - "3.1"
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2.4
  - 3.2.5
  - "3.3"
  - "3.4"
  - 3.4.1
  - 3.4.2
  - 3.4.3
  - 3.4.4
  - 3.4.5
  - "3.5"
  - 3.5b1
  - "3.6"
  - 3.6.1
  - 3.6.2
  - 3.6.3
  - 3.6.4
  - 3.6.5
  - 3.6.6
  - 3.6.7
  - "3.7"
  - "3.8"
  - 3.8.1
  - "3.9"
  - 3.9.1
  - 3.9.2
  - 3.9.3
  - 3.9b1
  ecosystem_specific: {}
references:
- type: WEB
  url: https://access.redhat.com/security/cve/CVE-2026-33236
- type: WEB
  url: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33236.json
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:10184
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:19712
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2026:37275
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=2449824
- type: FIX
  url: https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a
- type: EVIDENCE
  url: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H