CVE-2026-12261: A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisonin

NLTK (Natural Language Toolkit, a library for processing human language) versions 3.9.4 and earlier have a vulnerability in their downloader tool that allows one software package to corrupt or replace another package's trusted resources. The problem occurs because the downloader extracts files into shared folders and only checks if files are legitimate after they've already been written, enabling attackers to inject malicious code that persists even after restarting the program.