CVE-2026-12259

Katalog CVE

CVSS 5.3 · Medium EPSS 0,14%

Kerentanan Download of Code Without Integrity Check. Skor CVSS 3.0 5.3 (Medium) menurut huntr.dev.

Deskripsi (NVD)

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Undergoing Analysis

CVSS 3.0

5.3 (Medium), sumber huntr.dev
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 2,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633c35a5d