CVE-2026-12261: nltk downloader cross-package

Q: Is CVE-2026-12261 actively exploited?

No confirmed active exploitation of CVE-2026-12261 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-12261?

1) Upgrade nltk to 3.10.0 or later (PR #3625, commit 7a5740a). 2) Until patched, avoid calling nltk.download in production or CI at runtime; pre-download resources from a trusted source and bake them into images. 3) Pin and verify checksums of NLTK data directories, and mount them read-only at runtime. 4) Use a private, trusted mirror or restrict the downloader's server URL, and enforce TLS. 5) Detection: use file integrity monitoring on NLTK_DATA paths (corpora/, taggers/, tokenizers/), diff against known-good hashes, and alert on unexpected nltk.download calls in logs. 6) Inventory projects with nltk<3.10.0 via SBOM or pip audit (PYSEC-2026-3954, GHSA-ffj6-66c4-86gw).

Q: What systems are affected by CVE-2026-12261?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data preprocessing pipelines, NLP inference services, RAG pipelines, Jupyter notebook environments, CI/CD ML build images.

Q: What is the CVSS score for CVE-2026-12261?

CVE-2026-12261 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

CISO Take

NLTK's downloader extracts every package archive into shared directories such as corpora/ and taggers/ and only checks integrity after the files are already written, so one downloaded package can silently overwrite another package's trusted resources. The overwritten data is live immediately through normal NLTK calls and survives interpreter restarts, which means a poisoned tokenizer, tagger or corpus can quietly change the behavior of downstream NLP and ML pipelines. Exploitation needs a network position or a hostile package source plus user action (CVSS 5.3, medium, high attack complexity), there is no public exploit or Nuclei template, it is not in CISA KEV, and the EPSS score of 0.00211 is low in absolute terms even though it sits in the 90th percentile. The risk is integrity and reproducibility rather than code execution, but it matters most for regulated or audit-sensitive ML workflows and CI/CD build images that call nltk.download at build or run time. Upgrade nltk to 3.10.0 or later, pre-bake and hash-pin NLTK data in images, and stop fetching resources dynamically in production.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

Medium overall. CVSS 5.3 with high attack complexity, required user interaction and integrity-only impact (C:N/I:H/A:N). No known exploitation, no public exploit, not in CISA KEV, and EPSS is 0.00211. Risk rises for pipelines that run nltk.download automatically in CI, notebooks or production start-up, because they trust the download source and the shared namespace. Exposure is mostly through data and resource trust rather than a directly reachable service. Downstream dependents and package risk score are unknown, so blast radius is hard to size.

How does the attack unfold?

Initial Access

Attacker supplies a malicious NLTK data package via a compromised mirror, intercepted download, or untrusted index that a user or CI job downloads.

AML.T0010.002

Exploitation

The downloader extracts the archive into a shared namespace such as corpora/ or taggers/ before validating integrity, overwriting another package's trusted files.

AML.T0010.001

Persistence

Tampered resources remain in the NLTK data directory and load automatically across interpreter restarts and future runs.

AML.T0059

Impact

Downstream NLP and ML pipelines silently consume poisoned data, skewing tokenization, classification, training outputs, and audit reproducibility.

AML.T0018.000

Initial Access

Attacker supplies a malicious NLTK data package via a compromised mirror, intercepted download, or untrusted index that a user or CI job downloads.

AML.T0010.002

Exploitation

The downloader extracts the archive into a shared namespace such as corpora/ or taggers/ before validating integrity, overwriting another package's trusted files.

AML.T0010.001

Persistence

Tampered resources remain in the NLTK data directory and load automatically across interpreter restarts and future runs.

AML.T0059

Impact

Downstream NLP and ML pipelines silently consume poisoned data, skewing tokenization, classification, training outputs, and audit reproducibility.

AML.T0018.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
nltk	pip	< 3.10.0	`3.10.0`

Do you use nltk? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 11% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade nltk to 3.10.0 or later (PR #3625, commit 7a5740a). 2) Until patched, avoid calling nltk.download in production or CI at runtime; pre-download resources from a trusted source and bake them into images. 3) Pin and verify checksums of NLTK data directories, and mount them read-only at runtime. 4) Use a private, trusted mirror or restrict the downloader's server URL, and enforce TLS. 5) Detection: use file integrity monitoring on NLTK_DATA paths (corpora/, taggers/, tokenizers/), diff against known-good hashes, and alert on unexpected nltk.download calls in logs. 6) Inventory projects with nltk<3.10.0 via SBOM or pip audit (PYSEC-2026-3954, GHSA-ffj6-66c4-86gw).

How is it classified?

Supply ChainModel PoisoningFrameworkTraining DataAML.T0010.001- AI Software AML.T0010.002- Data AML.T0018.000- Poison AI Model AML.T0059- Erode Dataset Integrity

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MAP 4.1-Risks of third-party software and data are mapped

OWASP LLM Top 10

LLM03-Supply ChainLLM04-Data and Model Poisoning

Frequently Asked Questions

What is CVE-2026-12261?

NLTK's downloader extracts every package archive into shared directories such as corpora/ and taggers/ and only checks integrity after the files are already written, so one downloaded package can silently overwrite another package's trusted resources. The overwritten data is live immediately through normal NLTK calls and survives interpreter restarts, which means a poisoned tokenizer, tagger or corpus can quietly change the behavior of downstream NLP and ML pipelines. Exploitation needs a network position or a hostile package source plus user action (CVSS 5.3, medium, high attack complexity), there is no public exploit or Nuclei template, it is not in CISA KEV, and the EPSS score of 0.00211 is low in absolute terms even though it sits in the 90th percentile. The risk is integrity and reproducibility rather than code execution, but it matters most for regulated or audit-sensitive ML workflows and CI/CD build images that call nltk.download at build or run time. Upgrade nltk to 3.10.0 or later, pre-bake and hash-pin NLTK data in images, and stop fetching resources dynamically in production.

Is CVE-2026-12261 actively exploited?

No confirmed active exploitation of CVE-2026-12261 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12261?

1) Upgrade nltk to 3.10.0 or later (PR #3625, commit 7a5740a). 2) Until patched, avoid calling nltk.download in production or CI at runtime; pre-download resources from a trusted source and bake them into images. 3) Pin and verify checksums of NLTK data directories, and mount them read-only at runtime. 4) Use a private, trusted mirror or restrict the downloader's server URL, and enforce TLS. 5) Detection: use file integrity monitoring on NLTK_DATA paths (corpora/, taggers/, tokenizers/), diff against known-good hashes, and alert on unexpected nltk.download calls in logs. 6) Inventory projects with nltk<3.10.0 via SBOM or pip audit (PYSEC-2026-3954, GHSA-ffj6-66c4-86gw).

What systems are affected by CVE-2026-12261?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data preprocessing pipelines, NLP inference services, RAG pipelines, Jupyter notebook environments, CI/CD ML build images.

What is the CVSS score for CVE-2026-12261?

CVE-2026-12261 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata preprocessing pipelinesNLP inference servicesRAG pipelinesJupyter notebook environmentsCI/CD ML build images

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0010.002Data

AML.T0018.000Poison AI Model

AML.T0059Erode Dataset Integrity

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MAP 4.1

OWASP LLM Top 10: LLM03, LLM04

What are the technical details?

Original Advisory

A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.

Exploitation Scenario

An attacker publishes or controls a package served through a compromised mirror, an intercepted download, or a malicious custom data index, which a data scientist or CI job downloads with nltk.download. Because extraction lands in the shared corpora/ or taggers/ namespace before integrity validation, the archive overwrites a trusted resource such as a tagger or stopword list used by another package. The tampered resource is picked up by ordinary NLTK APIs and persists across restarts, so a text-classification or content-moderation pipeline begins producing manipulated tokenization and labels, for example letting selected phrases evade filters or biasing training data, with no obvious error.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.