CVE-2026-12259: NLTK Package Tampering Vulnerability

CVE-2026-12259 Overview

CVE-2026-12259 affects the Natural Language Toolkit (NLTK) Python library at version 3.9.4. The nltk.downloader.Downloader._download_package() function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. An attacker who can influence the response for info.url through a compromised mirror, malicious proxy, or other source-substitution condition can deliver attacker-controlled package bytes. Downstream users or applications may then trust malicious corpus or model content. The weakness is classified under [CWE-494: Download of Code Without Integrity Check].

Critical Impact
Attackers positioned on the network path can substitute NLTK package contents with malicious data before checksum validation, resulting in the installation of untrusted corpus or model files.

Affected Products

NLTK (Natural Language Toolkit) version 3.9.4
Python applications that call nltk.download() or use nltk.downloader.Downloader
Downstream applications consuming NLTK corpora and models fetched at runtime

Discovery Timeline

2026-08-03 - CVE-2026-12259 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-12259

Vulnerability Analysis

The flaw resides in nltk.downloader.Downloader._download_package(), the routine that retrieves NLTK data packages from a remote URL specified by info.url. The function writes the response body to disk and, in some execution paths, extracts archive contents before comparing the file's SHA-256 or MD5 digest against the value published in the package index. Because the integrity check happens after the bytes reach disk and are potentially unpacked, malicious content lands on the file system before it can be rejected.

Exploitation requires the attacker to influence the network path or the source of info.url. Practical conditions include a compromised NLTK mirror, a malicious HTTP proxy, DNS redirection, or a man-in-the-middle position on unencrypted transport. User interaction is required because a developer or application must invoke a download operation, and attack complexity is high due to the network positioning requirement. The impact concentrates on integrity: attacker-controlled bytes can replace legitimate corpora or model files, poisoning any downstream NLP pipeline that trusts them.

Root Cause

The root cause is a sequencing defect in the download workflow. Integrity validation is treated as a post-write step rather than a gate between the network response and the file system. This violates the [CWE-494] principle that code and data downloaded from remote sources must be verified before use or extraction.

Attack Vector

The attack vector is network-based and requires user interaction. An adversary substitutes the package response body served for info.url. The malicious archive is written to disk and may be extracted before the checksum mismatch is detected. Applications that pre-load extracted files, or that fail to abort on late-stage validation errors, will consume attacker-controlled content. See the Huntr Bounty Tracker for reporter details.

No verified public exploit code is available. The vulnerability is described in prose because no sanitized proof-of-concept has been released.

Detection Methods for CVE-2026-12259

Indicators of Compromise

Unexpected modifications to files under the local nltk_data directory, particularly newly extracted archives with mismatched checksums.
Outbound HTTP or HTTPS requests to hosts other than the configured NLTK index server during nltk.download() calls.
Presence of NLTK corpus or model files whose SHA-256 hashes do not match the values published in the official NLTK index.

Detection Strategies

Baseline the SHA-256 hashes of installed NLTK data packages and alert on drift compared to the upstream index.
Monitor Python process execution for nltk.downloader activity and correlate with the network destinations contacted during the download.
Inspect proxy and TLS inspection logs for connections to NLTK download endpoints originating from build servers, CI runners, or developer workstations.

Monitoring Recommendations

Alert on write operations to nltk_data paths from processes other than a controlled installer or package manager.
Track invocations of nltk.download() in application logs and CI pipeline output to identify unexpected runtime fetches.
Capture TLS certificate metadata for connections to NLTK mirrors to detect proxy interception or mirror substitution.

How to Mitigate CVE-2026-12259

Immediate Actions Required

Pin NLTK to a fixed version and avoid nltk.download() at application runtime; pre-stage data at build time in a controlled environment.
Verify downloaded NLTK data packages against upstream SHA-256 values before making them available to production processes.
Restrict outbound network access from application hosts so that only the official NLTK index or an internal, curated mirror is reachable.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the Huntr Bounty Tracker and the upstream NLTK project for a corrected release that enforces integrity validation before writing or extracting package contents.

Workarounds

Host an internal NLTK mirror populated from verified upstream archives, and configure nltk.data.path to consume only that mirror.
Enforce HTTPS with strict certificate validation for all NLTK downloads and block plaintext HTTP mirrors at the network egress point.
Wrap NLTK download calls with an out-of-band integrity check that computes the SHA-256 of the received file and aborts before any extraction or load step.

bash

# Pre-stage NLTK data with explicit integrity verification
expected="<sha256-from-official-index>"
curl -fsSL -o punkt.zip https://internal-mirror.example.com/nltk/punkt.zip
actual=$(sha256sum punkt.zip | awk '{print $1}')
[ "$expected" = "$actual" ] || { echo "integrity check failed"; rm -f punkt.zip; exit 1; }
unzip -d "$NLTK_DATA/tokenizers" punkt.zip