CVE-2026-79675
CriticalCVSS 9.8Summary
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.
Risk Assessment
The vulnerability may allow remote code execution in the context of the application using NLTK, potentially leading to full system compromise and data confidentiality breach.
Recommendation
It is recommended to upgrade NLTK to version 3.10.3 or later and avoid passing untrusted JVM options to the java() function.
Original NVD description (English source)
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.