CVE-2026-79675
Fixed in a distro release EPSS <1%CVSS 9.8
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.
Products: nltk
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nltk | 3.10.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nemo | 2.7.3-r27 |
| Chainguard | open-webui | 0.11.3-r1 |
| Debian 12 | nltk | no fix |
| Debian 13 | nltk | no fix |
| Debian 14 | nltk | 3.10.3-1 |
| Ubuntu Pro 14.04 LTS | nltk | no fix |
| Ubuntu Pro 16.04 LTS | nltk | no fix |
| Ubuntu Pro 18.04 LTS | nltk | no fix |
| Ubuntu Pro 20.04 LTS | nltk | no fix |
| Ubuntu Pro 22.04 LTS | nltk | no fix |
| Ubuntu Pro 24.04 LTS | nltk | no fix |
| Ubuntu Pro 26.04 LTS | nltk | no fix |
| Wolfi | open-webui | 0.11.3-r1 |