CVE-2026-12252: NLTK Stanford JAR Code Execution Flaw

Technical summary

The vulnerability stems from insufficient input validation in five StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser classes within NLTK. These classes accept user-supplied JAR file paths and pass them to a `java()` function that invokes `subprocess.Popen()` to launch the Stanford tools. No cryptographic integrity verification (such as SHA256 hashing) is performed on the JAR before execution. This is a variant of CVE-2026-0848, which was patched in StanfordSegmenter by adding mandatory SHA256 verification; however, the remediation was not backported to the five affected classes listed above. An attacker with local file system access or the ability to influence JAR path resolution can replace a legitimate Stanford JAR with a malicious one, achieving arbitrary code execution in the context of the NLTK application.

Business impact

Organizations deploying NLTK for text analysis, named entity recognition, or linguistic processing face a direct threat to application integrity and data confidentiality. In scenarios where NLTK runs as a backend service—such as document processing pipelines, chatbot engines, or automated content analysis systems—a compromise could lead to unauthorized data exfiltration, process manipulation, or lateral movement within the network. The risk is amplified if the NLTK application runs with elevated privileges or in shared environments where file system write access is not tightly controlled. Supply chain concerns also arise: if attackers can poison JAR artifacts in shared repositories or cached dependency folders, many downstream applications could be compromised simultaneously.

Affected systems

NLTK versions 3.9.3 and earlier are affected. The vulnerability is limited to applications explicitly using the five Stanford interface classes mentioned: StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser. Applications using other NLTK components or different NLP backends are not affected. The exposure depends on how the application obtains JAR paths—hardcoded paths are lower risk than paths derived from user input, environment variables, or dynamic discovery mechanisms.

Exploitability

Exploitation requires local file system access or the ability to influence how JAR paths are resolved within the application's runtime environment. The attack vector is local; remote exploitation is not directly possible. However, the barrier to exploitation is low once file system access is achieved: no special privileges are required, and user interaction is limited to typical application usage (e.g., submitting text for NLP processing). The CVSS 3.0 score of 7.8 (HIGH) reflects this combination: local attack vector, no privilege requirement, user interaction needed only for application-normal workflows, and high impact on confidentiality, integrity, and availability. The absence of KEV (Known Exploited Vulnerability) status indicates no public exploit toolkit has been observed in the wild as of the publication date, but the relative simplicity of the attack should not be discounted.

Remediation

Upgrade NLTK to a version released after July 8, 2026 that includes SHA256 verification for all five Stanford interface classes. Verify against the official NLTK GitHub repository and release notes for the exact patched version. As an interim control, restrict write access to directories containing JAR files, use read-only mounts where feasible, and validate JAR integrity through external mechanisms if patching is delayed. Monitor JAR file paths and execution logs for unexpected modifications or out-of-band JAR loads.

Patch guidance

Consult the NLTK project's official advisory and release notes to identify the first version that patches all five Stanford interface classes with SHA256 verification. Update NLTK through your package manager (pip, conda, or equivalent) and test the updated version in a staging environment to ensure compatibility with dependent code. If your organization uses pinned dependency versions, remove the pin and adopt the patched release. If you maintain a private mirror or offline cache of NLTK, refresh it with the patched version before allowing downstream consumers to update.

Detection guidance

Monitor execution of Java processes spawned by Python/NLTK applications, particularly those loading JAR files from unexpected or user-writable directories. Log all JAR file access within directories referenced by NLTK configuration or code. Implement file integrity monitoring (FIM) on directories containing Stanford JAR files to detect unauthorized modifications. Review application logs for `subprocess.Popen()` or `java()` calls with unusual arguments or paths. In containerized environments, use image scanning to detect vulnerable NLTK versions at build time. Network-level detection is difficult because the exploit is local; focus on endpoint and application logging.

Why prioritize this

This vulnerability merits immediate attention despite the absence of KEV status and local-only attack vector. The HIGH CVSS score, straightforward exploitation path, and widespread deployment of NLTK in data processing and AI pipelines create substantial risk. The fact that a similar vulnerability was previously patched in one class but not others suggests a maintenance gap that attackers may specifically exploit. Organizations should prioritize patching in the next maintenance window, particularly for systems that process untrusted input or run in multi-tenant environments.

Risk score, explained

The CVSS 3.0 score of 7.8 (HIGH) is driven by the combination of no privilege requirement (PR:N), low attack complexity (AC:L), and complete impact on confidentiality (C:H), integrity (I:H), and availability (A:H). The local attack vector (AV:L) prevents a critical score, and the requirement for user interaction (UI:R)—in the form of normal application usage—further moderates the score. However, in practice, the impact can be severe because arbitrary code execution allows an attacker to assume full control of the compromised process.

Frequently asked questions