GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-5WP5-5229-5G6Q

Vulnerability from github – Published: 2026-09-08 15:27 – Updated: 2026-09-08 15:27
VLAI
Summary
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
Details

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction.

The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replace(tmp_filepath, filepath) moves it to the final location (line 799) 3. Extraction begins via _unzip_iter() (line 825)

Between steps 2 and 3, there is no SHA-256 verification. The checksum logic exists in _pkg_status() (lines 982-1015) but it is only used BEFORE download as a status check ("is this package already installed and up-to-date?"). It is never called after download to verify the file that was actually received.

Attack vectors: 1. MITM during HTTP download (NLTK downloads from http:// by default on some mirrors) 2. Race condition on shared filesystems (attacker replaces file between os.replace and _unzip_iter) 3. DNS poisoning redirecting to attacker-controlled server

PoC:

import nltk
import unittest.mock
import zipfile
import io
import os

# Create a malicious zip that will be "downloaded"
malicious_zip = io.BytesIO()
with zipfile.ZipFile(malicious_zip, 'w') as zf:
    zf.writestr('punkt_tab/tokenizers/punkt_tab/english.pickle', 
                b'MALICIOUS PAYLOAD - attacker controlled content')

# Patch urllib to return our malicious zip
with unittest.mock.patch('urllib.request.urlopen') as mock_urlopen:
    mock_response = unittest.mock.MagicMock()
    mock_response.read.return_value = malicious_zip.getvalue()
    mock_response.headers = {'Content-Length': str(len(malicious_zip.getvalue()))}
    mock_urlopen.return_value = mock_response

    # Download proceeds, no integrity check catches the swap
    # nltk.download('punkt_tab')  # Would install attacker payload

This is distinct from CVE-2024-39705 (pickle deserialization via download) and CVE-2025-14009 (zip-slip path traversal). Those address what happens AFTER extraction. This finding addresses the gap BEFORE extraction where integrity is never verified.

Suggested fix: After os.replace() and before _unzip_iter(), compute SHA-256 of the final file and compare against the expected checksum from the package index. Reject and delete the file if the hash does not match.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.9.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-12259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-494"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T15:27:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "NLTK\u0027s package downloader in nltk/downloader.py does not verify file integrity after download and before extraction.\n\nThe download flow at lines 789-825:\n1. File is downloaded to a temp path via HTTP\n2. os.replace(tmp_filepath, filepath) moves it to the final location (line 799)\n3. Extraction begins via _unzip_iter() (line 825)\n\nBetween steps 2 and 3, there is no SHA-256 verification. The checksum logic exists in _pkg_status() (lines 982-1015) but it is only used BEFORE download as a status check (\"is this package already installed and up-to-date?\"). It is never called after download to verify the file that was actually received.\n\nAttack vectors:\n1. MITM during HTTP download (NLTK downloads from http:// by default on some mirrors)\n2. Race condition on shared filesystems (attacker replaces file between os.replace and _unzip_iter)\n3. DNS poisoning redirecting to attacker-controlled server\n\nPoC:\n```python\nimport nltk\nimport unittest.mock\nimport zipfile\nimport io\nimport os\n\n# Create a malicious zip that will be \"downloaded\"\nmalicious_zip = io.BytesIO()\nwith zipfile.ZipFile(malicious_zip, \u0027w\u0027) as zf:\n    zf.writestr(\u0027punkt_tab/tokenizers/punkt_tab/english.pickle\u0027, \n                b\u0027MALICIOUS PAYLOAD - attacker controlled content\u0027)\n\n# Patch urllib to return our malicious zip\nwith unittest.mock.patch(\u0027urllib.request.urlopen\u0027) as mock_urlopen:\n    mock_response = unittest.mock.MagicMock()\n    mock_response.read.return_value = malicious_zip.getvalue()\n    mock_response.headers = {\u0027Content-Length\u0027: str(len(malicious_zip.getvalue()))}\n    mock_urlopen.return_value = mock_response\n    \n    # Download proceeds, no integrity check catches the swap\n    # nltk.download(\u0027punkt_tab\u0027)  # Would install attacker payload\n```\n\nThis is distinct from CVE-2024-39705 (pickle deserialization via download) and CVE-2025-14009 (zip-slip path traversal). Those address what happens AFTER extraction. This finding addresses the gap BEFORE extraction where integrity is never verified.\n\nSuggested fix: After os.replace() and before _unzip_iter(), compute SHA-256 of the final file and compare against the expected checksum from the package index. Reject and delete the file if the hash does not match.",
  "id": "GHSA-5wp5-5229-5g6q",
  "modified": "2026-09-08T15:27:55Z",
  "published": "2026-09-08T15:27:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12259"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/pull/3449"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/commit/0e26734a61094b628d93e26dc18dd7302567ac46"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nltk/nltk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/releases/tag/3.9.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3729.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/659ccf6d-12d4-4d4a-84c0-078633c35a5d"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verification"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.