CVE-2026-79675 nltk CVE debrief

Who should care

Developers and administrators using the NLTK library, especially those who utilize the java() function, should be aware of this critical vulnerability. Immediate action is required to patch systems and prevent potential exploitation.

Technical summary

The NLTK library before version 3.10.3 contains a critical vulnerability (CVE-2026-79675) that allows attackers to inject malicious JVM flags through the per-call options parameter in the java() function. This can lead to arbitrary code execution, with a CVSS score of 9.3. The vulnerability is caused by inadequate validation of JVM options passed to the java() function, enabling attackers to supply dangerous flags like -agentpath, -javaagent, or @argfile to Stanford wrapper classes.

Defensive priority

Immediate attention is required due to the critical severity of this vulnerability, with a CVSS score of 9.3. Affected systems should be prioritized for patching to prevent potential code execution.

Recommended defensive actions

• Apply the patch for NLTK version 3.10.3 or later to prevent exploitation of this vulnerability.
• Inventory systems using NLTK to identify potential exposure.
• Implement compensating controls, such as monitoring for suspicious JVM flag usage, until patching can be completed.
• Consider temporarily disabling the java() function's per-call options parameter if an immediate patch is not feasible.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-79675 record indicates that NLTK before version 3.10.3 is vulnerable to a critical issue allowing attackers to inject dangerous JVM flags through the per-call options parameter in the java() function, potentially leading to arbitrary code execution. Official sources, including the CVE Program and NVD, confirm this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.