Fluid Attacks Database

Description

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.repr_svg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.5-1 \|\| =3.6.5-1 \|\| =3.6.7-1 \|\| =3.7-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 12	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 13	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 14	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1 \|\| >=0 <3.10.3-1	3.10.3-1

Aliases

1. CVE-2026-786802. NVD-2026-786803. OSV-DEBIAN-2026-786804. OSV-2026-786805. SECURITY-TRACKER-CVE-2026-78680