CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
Attackers can execute arbitrary code by supplying malicious JAR files to the NLTK StanfordSegmenter module, affecting Python NLP applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0848?
CVE-2026-0848 is a critical code injection vulnerability in nltk/nltk, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Weakness: CWE-20
Which versions are affected by CVE-2026-0848?
1 open source package ship an affected version, including nltk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nltk PyPI | All versions | 3.9.3 |
Products include Nltk Nltk.
How do I fix CVE-2026-0848?
Upgrade nltk to 3.9.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-0848 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0848 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in nltk/nltk
- CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution
- CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
- CVE-2026-79674 NLTK 3.10.2 Path Traversal via corpus-reader constructors
Sources
Also known as DEBIAN-CVE-2026-0848, GHSA-v2w2-xcg6-53wj, PYSEC-2026-99.