https://vulnerability.circl.lu/sightings/feed 2026-09-16T01:47:51.079816+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fa7e8f02-5ffb-4b1e-b1c7-d0b14e588e17/export 2026-09-16T01:47:51.096526+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fa7e8f02-5ffb-4b1e-b1c7-d0b14e588e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6hwm-xvph-95vm", "type": "seen", "source": "https://gist.github.com/alon710/7b6bce40e6566e480602c24860523089", "content": "# CVE-2026-78680: CVE-2026-78680: Arbitrary Code Execution in NLTK via Untrusted Graphviz Path Resolution\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-78680\n\n## Summary\nAn Untrusted Search Path (CWE-426) vulnerability exists in the Natural Language Toolkit (NLTK) library when executing the Graphviz 'dot' utility. Because the library fails to enforce absolute paths when executing external commands, local attackers can plant a malicious binary named 'dot' inside the current working directory. The library then executes the malicious binary, resulting in local arbitrary code execution under the context of the running Python process.\n\n## TL;DR\nNLTK versions prior to 3.10.3 are vulnerable to local arbitrary code execution via an untrusted search path flaw when invoking the Graphviz 'dot' command.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-426, CWE-427\n- **Attack Vector**: Local (L)\n- **CVSS v3.1 Score**: 7.8 (High)\n- **CVSS v4.0 Score**: 8.5 (High)\n- **EPSS Score**: 0.0012 (Percentile: 2.07%)\n- **Exploit Maturity**: Proof of Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- NLTK library installations on Windows\n- NLTK library installations on Linux/macOS with relative directory entries in PATH\n- **nltk**: < 3.10.3 (Fixed in: `3.10.3`)\n\n## Mitigation\n\n- Upgrade NLTK dependency to version 3.10.3 or higher.\n- Remove relative directory markers (like '.') and empty paths from the system PATH environment variable.\n- Avoid running Python/NLTK scripts inside directories that contain untrusted or user-writeable files.\n\n**Remediation Steps:**\n1. Identify current NLTK installations using command: pip show nltk\n2. Upgrade NLTK by running: pip install --upgrade nltk>=3.10.3\n3. Verify installation by checking version in Python: python -c \"import nltk; print(nltk.__version__)\"\n4. Ensure that local workspace directories do not contain arbitrary executables named 'dot' or 'dot.exe'\n\n## References\n\n- [https://github.com/nltk/nltk/security/advisories/GHSA-6hwm-xvph-95vm](https://github.com/nltk/nltk/security/advisories/GHSA-6hwm-xvph-95vm)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-78680](https://nvd.nist.gov/vuln/detail/CVE-2026-78680)\n- [https://www.vulncheck.com/advisories/nltk-before-arbitrary-code-execution-via-graphviz-dot-binary](https://www.vulncheck.com/advisories/nltk-before-arbitrary-code-execution-via-graphviz-dot-binary)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-78680) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T09:31:32.845721Z"} 2026-09-02T09:31:32.845721+00:00