CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter of its java() interface, an argument-injection flaw (CWE-88). An attacker who can influence the options string supplied to the Stanford wrapper classes can inject dangerous JVM flags such as -agentpath, -javaagent, or @argfile, causing the launched Java Virtual Machine to load attacker-controlled code or read attacker-supplied argument files. This yields arbitrary code execution with the privileges of the process running NLTK, with high impact to confidentiality, integrity, and availability and no privileges or user interaction required (CVSS 4.0 score 9.3). Any Python application running an affected NLTK version that invokes the java()-backed Stanford wrappers with attacker-influenced options — for example, NLP services that pass user-controlled settings into these wrappers — is affected. No in-the-wild exploitation is known; a public security advisory/PoC exists, the EPSS score is a modest 0.4% (36th percentile), and the issue is not in CISA KEV.

What to do: Upgrade to NLTK 3.10.3 or later, which validates JVM options before passing them to the JVM. As an interim measure, never pass untrusted input to the options parameter of nltk.java() or the Stanford wrapper classes; whitelist permitted JVM flags and reject flags such as -agentpath, -javaagent, and @argfile references. Audit whether any network-facing services feed user-controlled values into these wrappers.