CVE-2026-78680: NLTK Graphviz Binary RCE Vulnerability

CVE-2026-78680 Overview

CVE-2026-78680 is an untrusted search path vulnerability [CWE-426] affecting the Natural Language Toolkit (NLTK) Python library in versions prior to 3.10.3. The flaw resides in dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary using its bare name rather than a validated absolute path. Attackers can plant a malicious dot executable in the current working directory on Windows or in a relative PATH entry on Unix-like systems. When NLTK triggers rendering, the operating system resolves the attacker-controlled binary and executes it in the context of the calling user.

Critical Impact
Local attackers can achieve arbitrary code execution in the context of any user or service that imports NLTK and renders dependency graphs or aligned sentences.

Affected Products

NLTK (Natural Language Toolkit) versions prior to 3.10.3
Python applications calling nltk.parse.dependencygraph.dot2img
Python applications rendering AlignedSent._repr_svg_ (for example, in Jupyter notebooks)

Discovery Timeline

2026-08-25 - CVE-2026-78680 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78680

Vulnerability Analysis

NLTK relies on Graphviz to render dependency graphs into image formats. The affected code paths dependencygraph.dot2img and AlignedSent._repr_svg_ spawn the dot binary using its unqualified name. Neither function calls shutil.which with validation, nor does it pin execution to a trusted absolute path such as /usr/bin/dot or C:\Program Files\Graphviz\bin\dot.exe.

Because the binary name is passed to the operating system loader without a directory component, the loader resolves it through the standard search path. On Windows, that search order historically includes the current working directory before system directories. On Unix-like systems, administrators or developers frequently prepend relative entries such as . to PATH, producing equivalent behavior.

The vulnerability categorizes as Local Code Execution driven by an untrusted search path. Exploitation does not require network access and executes with the privileges of the process importing NLTK.

Root Cause

The root cause is unvalidated bare-name binary resolution [CWE-426]. NLTK trusts the process environment to locate dot, rather than resolving and validating an absolute path before invoking subprocess. Any writable directory that appears earlier than the legitimate Graphviz install in the resolution order becomes a code execution primitive.

Attack Vector

An attacker with local write access to the working directory of a target Python process places a malicious executable named dot (or dot.exe on Windows) in that directory. When a data scientist, CI job, or web service invokes an NLTK code path that renders a graph, the attacker's binary runs in place of Graphviz. Multi-user systems, shared build agents, and notebook environments where the current working directory is user-writable are the primary exposure surface.

No verified proof-of-concept code is published. See the GitHub Security Advisory and the VulnCheck Security Advisory for maintainer details.

Detection Methods for CVE-2026-78680

Indicators of Compromise

Presence of dot or dot.exe files in application working directories, user home directories, or notebook project folders outside of standard Graphviz install paths.
Process telemetry showing a python or jupyter process spawning a dot binary from a non-standard location such as a temp directory, download folder, or shared workspace.
Unexpected child processes (shells, powershell.exe, cmd.exe, curl, wget) forked from a dot execution chain.

Detection Strategies

Inventory installed NLTK versions across developer workstations, data pipelines, and container images, flagging any version below 3.10.3.
Alert on execution of binaries named dot whose image path is not the vendor-installed Graphviz location.
Correlate Python interpreter parent processes with binary drops in the current working directory immediately preceding execution.

Monitoring Recommendations

Enable command-line and process-lineage logging on hosts running data science and NLP workloads.
Monitor CI/CD runners and Jupyter servers for filesystem writes to working directories that match dot* names.
Audit PATH environment variables on Unix hosts for relative entries such as . or ./bin, which enable the same class of hijack.

How to Mitigate CVE-2026-78680

Immediate Actions Required

Upgrade NLTK to version 3.10.3 or later across all environments that import the library.
Remove any untrusted dot binaries from user-writable directories in the search path of Python processes.
Review and sanitize PATH on shared hosts to remove relative or user-writable entries preceding system directories.

Patch Information

The maintainers fixed the issue in NLTK 3.10.3 by resolving the Graphviz dot binary to a validated absolute path before invoking subprocess. Refer to the GitHub Security Advisory GHSA-6hwm-xvph-95vm for the patch commit and remediation guidance.

Workarounds

Set an explicit absolute path to Graphviz and ensure NLTK invocations run from directories that are not writable by untrusted users.
On Windows, disable current-directory search for executables using the SafeDllSearchMode and CWDIllegalInDllSearch protections where applicable.
Run NLTK-consuming workloads inside containers or sandboxes with read-only working directories and a curated PATH.

bash

# Configuration example
pip install --upgrade 'nltk>=3.10.3'

# Verify installed version
python -c "import nltk; print(nltk.__version__)"

# Remove relative entries from PATH (bash)
export PATH="$(echo "$PATH" | tr ':' '\n' | grep -vE '^(\.|\./)' | paste -sd:)"