CVE-2026-12252 Overview
CVE-2026-12252 affects the Natural Language Toolkit (NLTK) Python library in versions 3.9.3 and earlier. Five Stanford interface classes execute user-controllable JAR files without integrity verification. The affected classes are StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser. Each class passes attacker-controlled JAR paths to the internal java() function, which invokes subprocess.Popen() directly. The issue mirrors CVE-2026-0848, which was remediated in StanfordSegmenter through SHA256 verification. The fix was never propagated to these additional classes. This vulnerability is classified under [CWE-94] Improper Control of Generation of Code.
Critical Impact
Attackers who can influence JAR file paths loaded by NLTK Stanford interfaces achieve arbitrary code execution in the context of the Python process.
Affected Products
- NLTK versions 3.9.3 and earlier
- Python applications using StanfordPOSTagger, StanfordNERTagger, or StanfordParser
- Python applications using StanfordDependencyParser or StanfordNeuralDependencyParser
Discovery Timeline
- 2026-07-04 - CVE-2026-12252 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-12252
Vulnerability Analysis
The five affected Stanford interface classes in NLTK wrap Stanford NLP tooling written in Java. Each class accepts a user-supplied path to a JAR archive that provides the underlying Stanford functionality. The classes forward this path to an internal java() helper, which builds a command line and calls subprocess.Popen() to spawn a Java process. No cryptographic verification confirms the JAR originates from a trusted source. An attacker who can substitute the JAR — through a supply chain compromise, a writable directory, or by convincing a user to load a malicious file — executes arbitrary code with the privileges of the Python interpreter. The vulnerability requires local access and user interaction, but yields high impact to confidentiality, integrity, and availability.
Root Cause
The root cause is the absence of integrity validation before execution. When CVE-2026-0848 was patched, maintainers added SHA256 hash verification only to StanfordSegmenter. The remediation was not extended to sibling classes sharing the same execution pattern. Any JAR path accepted by the constructor is executed without a hash allowlist, signature check, or path restriction.
Attack Vector
The vulnerability manifests when a user or automated workflow instantiates one of the five Stanford interface classes and points it at a JAR the attacker controls. See the Huntr Bounty Listing for a detailed proof-of-concept demonstrating the code path from constructor to subprocess.Popen() invocation. Because execution occurs through the standard Java runtime, the payload can be any class with a main method or a JAR manifest defining a Main-Class entry.
Detection Methods for CVE-2026-12252
Indicators of Compromise
- Unexpected java child processes spawned by Python interpreters running NLTK workloads
- JAR files located in world-writable directories referenced by NLTK configuration
- Outbound network connections initiated by java processes launched from Python parents
- Modifications to Stanford JAR files not matching known-good SHA256 hashes
Detection Strategies
- Inventory Python environments for NLTK versions at or below 3.9.3 using package managers or SBOM tooling
- Monitor process creation events where python or python3 is the parent of java executing an untrusted JAR path
- Baseline the SHA256 of legitimate Stanford JAR files and alert on hash deviations
- Instrument application logs to record every JAR path passed to Stanford interface constructors
Monitoring Recommendations
- Enable command-line argument logging for subprocess calls originating from analytics and NLP pipelines
- Alert on Python-spawned java processes running from user home directories, /tmp, or shared upload locations
- Correlate NLTK usage in CI/CD runners with unexpected outbound traffic from build agents
How to Mitigate CVE-2026-12252
Immediate Actions Required
- Upgrade NLTK to a version that extends SHA256 verification to all Stanford interface classes once released
- Restrict Stanford JAR paths to a read-only, integrity-verified directory owned by root or a service account
- Remove or gate use of StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser in production code paths
- Audit dependency manifests and CI pipelines for pinned NLTK versions matching 3.9.3 or earlier
Patch Information
At the time of publication, no vendor advisory URL is listed for CVE-2026-12252. Track the Huntr Bounty Listing and the upstream nltk/nltk repository for a release that propagates SHA256 verification — the mitigation applied for CVE-2026-0848 in StanfordSegmenter — to the five affected classes.
Workarounds
- Wrap Stanford class instantiations with a pre-execution hash check comparing the JAR SHA256 against a maintained allowlist
- Enforce filesystem permissions so that only administrators can write to directories referenced by NLTK model paths
- Execute NLTK Stanford workloads inside a sandbox or container with no network egress and minimal filesystem privileges
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
