CVE-2026-78680 nltk CVE debrief

Who should care

Defenders responsible for NLTK deployments, particularly those using versions before 3.10.3, should assess exposure and verify the integrity of the Graphviz dot binary in their environments.

Why it matters

CVE-2026-78680 is a high-severity vulnerability in NLTK versions before 3.10.3, allowing attackers to execute arbitrary code by manipulating the search path or current working directory to invoke a malicious Graphviz dot binary instead of the legitimate one. Defenders should prioritize verifying NLTK versions and ensuring the integrity of the Graphviz dot binary in their environments.

• Potential arbitrary code execution via malicious Graphviz dot binary.
• Possible lateral movement and privilege escalation.
• Required verification of NLTK versions and Graphviz dot binary integrity.
• Potential disruption of services using NLTK and Graphviz.

Technical summary

The vulnerability is caused by NLTK's failure to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_. This allows attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. The vulnerability affects NLTK versions before 3.10.3 and can be exploited via relative PATH entries on Unix-like systems or bare-name binary resolution on Windows via the current working directory. Defenders should prioritize verifying NLTK versions and ensuring the integrity of the Graphviz dot binary in their environments.

Defensive priority

Defenders should prioritize verifying NLTK versions and ensuring the integrity of the Graphviz dot binary in their environments.

Recommended defensive actions

• Verify NLTK versions in use and ensure they are updated to 3.10.3 or later.
• Validate the integrity of the Graphviz dot binary in the environment.
• Monitor for suspicious activity related to NLTK and Graphviz usage.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by NLTK's failure to use validated absolute paths when invoking the Graphviz dot binary. This allows attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.