CVE-2026-12261: nltk.downloader cross-package resource and model poisoning via shared namespaces

Summary

CVE-2026-12261 affects `nltk.downloader` in nltk/nltk versions <= 3.9.4. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` rather than package-isolated roots, and checks package integrity only after extraction. One package can therefore overwrite another package's trusted resources, and the changes take effect through ordinary NLTK APIs and persist across interpreter restarts, affecting downstream machine learning pipelines.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• nltkPyPINo LLM dependency detected · 47 tracked dependents

Related items

• MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
• MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online