CVE-2026-79675 Overview
CVE-2026-79675 is an argument injection vulnerability in the Natural Language Toolkit (NLTK) Python library before version 3.10.3. The flaw resides in the java() function, which fails to validate JVM options supplied through the per-call options parameter. Attackers can inject dangerous JVM flags such as -agentpath, -javaagent, or @argfile when Stanford wrapper classes invoke Java subprocesses. Successful exploitation results in arbitrary code execution in the context of the calling application. The vulnerability is categorized under CWE-88: Improper Neutralization of Argument Delimiters in a Command.
Critical Impact
Attacker-controlled JVM flags allow arbitrary code execution through Java agent loading or argument file injection in applications using NLTK's Stanford wrappers.
Affected Products
- NLTK (Natural Language Toolkit) versions prior to 3.10.3
- Applications using NLTK Stanford wrapper classes (StanfordTagger, StanfordParser, StanfordNERTagger, and related)
- Python environments invoking nltk.internals.java() with untrusted options
Discovery Timeline
- 2026-08-25 - CVE-2026-79675 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79675
Vulnerability Analysis
NLTK provides Java-based integrations through Stanford NLP wrapper classes. These wrappers rely on the internal java() helper to launch a JVM subprocess. The function accepts an options parameter intended for benign tuning flags like heap size. Before version 3.10.3, NLTK passes these options directly to the Java command line without validating against a safelist. An attacker who controls any value flowing into options can supply flags that alter JVM startup behavior. This turns a text-processing call into a code execution primitive.
Root Cause
The root cause is missing input validation on JVM arguments (CWE-88). The java() function concatenates caller-supplied options into the argv passed to the java binary. It does not distinguish between resource-tuning flags and flags that load external code. JVM options such as -agentpath:/path/to/lib.so, -agentlib:name, -javaagent:/path/to/agent.jar, and @/path/to/argfile all cause the JVM to load or execute attacker-controlled content at startup.
Attack Vector
Exploitation requires an application that passes untrusted data into the options parameter of an NLTK function that eventually calls java(), such as a Stanford wrapper. The attacker submits payloads containing malicious JVM flags. When NLTK spawns the Java subprocess, the JVM honors the injected flag before executing the intended Stanford class. For example, -javaagent loads a JAR whose premain method runs with full JVM privileges. The @argfile syntax reads additional arguments from an attacker-referenced file, expanding the injection surface. No authentication or user interaction is required when the vulnerable code path is reachable over the network.
See the GitHub Security Advisory GHSA-m4rf-3fr8-xwx3 and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-79675
Indicators of Compromise
- Java subprocesses spawned by Python processes with command lines containing -agentpath, -agentlib, -javaagent, or @ argument-file references.
- Unexpected shared libraries or JAR files written to writable directories prior to NLTK invocations.
- Outbound network connections initiated by java child processes of Python interpreters running NLTK workloads.
Detection Strategies
- Inventory Python environments for nltk package versions below 3.10.3 using pip list or software composition analysis tools.
- Audit application source for calls to nltk.tag.stanford, nltk.parse.stanford, nltk.tokenize.stanford, and any direct use of nltk.internals.java() where the options argument is influenced by user input.
- Alert on process-creation events where python is the parent of java and the argv contains agent or argfile flags.
Monitoring Recommendations
- Log full command lines for JVM launches in production and forward them to a centralized data lake for correlation.
- Monitor file creation of .so, .dll, and .jar files under application working directories, tmp paths, and web upload sinks.
- Track EDR telemetry for Java processes making unexpected execve, LoadLibrary, or outbound socket calls shortly after startup.
How to Mitigate CVE-2026-79675
Immediate Actions Required
- Upgrade NLTK to version 3.10.3 or later in all Python environments, including containers, CI runners, and data-science notebooks.
- Identify every code path that forwards HTTP, form, or database input into NLTK Stanford wrappers and treat those endpoints as high risk until patched.
- Restrict outbound network access from hosts running NLTK Java integrations to limit second-stage payload retrieval.
Patch Information
The NLTK maintainers fixed the issue in version 3.10.3 by validating JVM options against a strict safelist and rejecting agent-loading and argument-file flags. Refer to the GHSA-m4rf-3fr8-xwx3 advisory for the authoritative fix commit and release notes.
Workarounds
- If patching is not immediately possible, remove or disable code paths that pass user-controlled data to the options parameter of NLTK Java-invoking functions.
- Wrap NLTK calls with an allowlist that permits only known-safe JVM flags such as -Xmx and -Xms, rejecting anything containing agent, javaagent, or leading @ characters.
- Run NLTK workloads under a least-privileged service account inside a sandbox or container with no write access to shared library directories.
# Upgrade NLTK to the fixed release
pip install --upgrade 'nltk>=3.10.3'
# Verify installed version
python -c "import nltk; print(nltk.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
