PyPI/nltk CVE-2026-12259, CVE-2026-63310: high 7.1
Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.9.2 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-gf32-cmjh-8m9v
- https://github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-63310
- https://www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verification
CVE-2026-12259, CVE-2026-63310 · published · modified · JSON