Ghostwire

CVE-2026-63310: NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader...

HIGH CVSS 7.1 Exploit Available

Published: August 22, 2026 | Last Modified: August 22, 2026

Description

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

Ghostwire Analysis — What This Means Practically

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

github.com/nltk/nltk/security/advisories/GHSA-5wp5-5229-5g6q
www.vulncheck.com/advisories/nltk-before-missing-post-download-integrity-verific
www.tenable.com/cve/CVE-2026-63310
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-63310