{"action":"Upgrade nltk to 3.9.4 or later.","affected":[{"fixed":"3.9.4","introduced":"0"}],"component":"nltk","cve_ids":["CVE-2026-33230"],"ecosystem":"PyPI","epss":0.00336,"exploited":false,"fixed_versions":["3.9.4"],"ghsa_id":"GHSA-gfwx-w7gr-fvh7","id":"tcs_01M5KFHHSYZN4MN44PS19G8NSB","modified_at":"2026-09-10T03:50:39.207692385Z","published_at":"2026-03-18T20:23:33Z","references":["https://osv.dev/vulnerability/GHSA-gfwx-w7gr-fvh7","https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7","https://nvd.nist.gov/vuln/detail/CVE-2026-33230","https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f","https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e","https://github.com/nltk/nltk"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-gfwx-w7gr-fvh7","url":"https://osv.dev/vulnerability/GHSA-gfwx-w7gr-fvh7"}],"summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk"}