CVE-2026-0848
CRITICALNLTK <=3.9.2 - Remote Code Execution via StanfordSegmenter JAR Loading
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-0848. PoCs published by fevar54, HyperPS.
AI-analyzed exploit summary This repository contains a scanner for detecting the presence of vulnerable NLTK installations (CVE-2026-0848) by checking file system paths, pip versions, and local system details. It does not include exploit code but identifies potential targets.
Description
NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of arbitrary Java bytecode at import time. This vulnerability can be exploited through methods such as model poisoning, MITM attacks, or dependency poisoning, leading to remote code execution. The issue arises from the direct execution of the JAR file via subprocess with unvalidated classpath input, allowing malicious classes to execute when loaded by the JVM.
Exploits (3)
This repository contains a scanner for detecting the presence of vulnerable NLTK installations (CVE-2026-0848) by checking file system paths, pip versions, and local system details. It does not include exploit code but identifies potential targets.
This repository contains a functional exploit for CVE-2026-0848, demonstrating RCE via a malicious JAR file loaded by NLTK's StanfordSegmenter. The exploit leverages improper input validation to execute arbitrary code when the JAR is loaded.
This repository provides a detailed technical analysis of CVE-2026-0848, a critical vulnerability in NLTK's StanfordSegmenter that allows arbitrary code execution via untrusted JAR loading. It includes a proof-of-concept demonstrating how a malicious JAR can be crafted and executed through NLTK's Java subprocess invocation.
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H