{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.9.4"}],"component":"nltk","cve_ids":["CVE-2026-12372"],"ecosystem":"PyPI","epss":0.0026,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2jhm-w3mp-jcwr","id":"tcs_01M5KH8X1ED5TXV699C3NHA5D4","modified_at":"2026-10-15T14:45:08.355892144Z","published_at":"2026-08-09T23:16:35.793Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3955","https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db","https://github.com/advisories/GHSA-2jhm-w3mp-jcwr"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-3955","url":"https://osv.dev/vulnerability/PYSEC-2026-3955"}],"summary":"A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by re"}