PyPI/nltk CVE-2025-14009: critical 10, EPSS 1.04%

NLTK has a Zip Slip Vulnerability

Action: Upgrade nltk to 3.9.3 or later.

pip install nltk==3.9.3

Affected

Fixed versions

Sources

• osv: GHSA-7p94-766c-hgjp
• https://nvd.nist.gov/vuln/detail/CVE-2025-14009
• https://github.com/nltk/nltk/pull/3468
• https://github.com/nltk/nltk/commit/1056b323af6462455571302e766b67cf300aea18
• https://github.com/nltk/nltk
• https://github.com/nltk/nltk/blob/4154eb85e832f266660a09286c7e37e308292284/ChangeLog#L1
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-96.yaml
• https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4

CVE-2025-14009 · published 2026-02-18T18:30:40Z · modified 2026-09-10T03:50:34.416389229Z · JSON