CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

Scoring

Severity
CRITICAL
CVSS base score
9.3
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS probability
0.12%
CWE
CWE-494
Published
2026-08-22
Last modified
2026-08-24

Affected products

Weakness type

Related vulnerabilities

Markdown version · Browse all CVEs