{"id":"CVE-2026-79675","title":"nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options (CVE-2026-79675)","summary":"A flaw was found in NLTK. When processing untrusted input for its `per-call options` parameter in the `java()` function, NLTK fails to validate Java Virtual Machine (JVM) options. A remote attacker could exploit this by injecting dangerous…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-88","vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","openshift_ai_rhoai"],"patched":["nltk 3.10.3"],"published":"2026-08-25","updated":"2026-09-15","sourceUpdated":"2026-09-15T13:22:06+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79675.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79675.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-79675"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523556"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79675"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79675"},{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3"},{"url":"https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options"},{"url":"https://github.com/nltk/nltk/commit/8fa9650b6009aacfdebbc33d2a08d32c0858ea6c"},{"url":"https://github.com/nltk/nltk"},{"url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"url":"https://github.com/advisories/GHSA-m4rf-3fr8-xwx3"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00426,"epssPercentile":0.36386,"aliases":["GHSA-m4rf-3fr8-xwx3","PYSEC-2026-3749"],"ecosystem":"pip","scores":{"vendor":8.1,"osv":9.8},"ingestedAt":"2026-09-01T21:32:41.640Z","slug":"CVE-2026-79675","body":"## Overview\n\nA flaw was found in NLTK. When processing untrusted input for its `per-call options` parameter in the `java()` function, NLTK fails to validate Java Virtual Machine (JVM) options. A remote attacker could exploit this by injecting dangerous JVM flags, such as -agentpath or -javaagent, to achieve arbitrary code execution. Successful exploitation requires specific conditions, indicating a higher attack complexity.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed, … · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79675.json)\n\n**nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options** — rated Important by Red Hat. Released 2026-08-25, updated 2026-09-15.\n\nAffected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Exploit Intelligence\n- Red Hat Ansible Automation Platform 2\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat OpenShift AI (RHOAI)\n\nNot affected:\n\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-79675)\n\nAffected packages:\n\n- `nltk < 3.10.3`\n\nPatched in:\n\n- `nltk 3.10.3`\n\nSource: https://osv.dev/vulnerability/GHSA-m4rf-3fr8-xwx3","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":203878,"id":"CVE-2026-79675","ts":1789490210599,"field":"cvss","old":"9.8","new":"8.1"},{"seq":203877,"id":"CVE-2026-79675","ts":1789490210599,"field":"severity","old":"critical","new":"high"},{"seq":201995,"id":"CVE-2026-79675","ts":1789399993757,"field":"cvss","old":"8.1","new":"9.8"},{"seq":201994,"id":"CVE-2026-79675","ts":1789399993757,"field":"severity","old":"high","new":"critical"},{"seq":200722,"id":"CVE-2026-79675","ts":1789397585812,"field":"cvss","old":"9.8","new":"8.1"},{"seq":200721,"id":"CVE-2026-79675","ts":1789397585812,"field":"severity","old":"critical","new":"high"},{"seq":199417,"id":"CVE-2026-79675","ts":1789395484490,"field":"cvss","old":"8.1","new":"9.8"},{"seq":199416,"id":"CVE-2026-79675","ts":1789395484490,"field":"severity","old":"high","new":"critical"},{"seq":198662,"id":"CVE-2026-79675","ts":1789392188465,"field":"cvss","old":"9.8","new":"8.1"},{"seq":198661,"id":"CVE-2026-79675","ts":1789392188465,"field":"severity","old":"critical","new":"high"},{"seq":196993,"id":"CVE-2026-79675","ts":1789384273603,"field":"cvss","old":"8.1","new":"9.8"},{"seq":196992,"id":"CVE-2026-79675","ts":1789384273603,"field":"severity","old":"high","new":"critical"},{"seq":194124,"id":"CVE-2026-79675","ts":1789378694310,"field":"cvss","old":"9.8","new":"8.1"},{"seq":194123,"id":"CVE-2026-79675","ts":1789378694310,"field":"severity","old":"critical","new":"high"},{"seq":192911,"id":"CVE-2026-79675","ts":1789376494833,"field":"cvss","old":"8.1","new":"9.8"},{"seq":192910,"id":"CVE-2026-79675","ts":1789376494833,"field":"severity","old":"high","new":"critical"},{"seq":191698,"id":"CVE-2026-79675","ts":1789373590659,"field":"cvss","old":"9.8","new":"8.1"},{"seq":191697,"id":"CVE-2026-79675","ts":1789373590659,"field":"severity","old":"critical","new":"high"},{"seq":190483,"id":"CVE-2026-79675","ts":1789369450046,"field":"cvss","old":"8.1","new":"9.8"},{"seq":190482,"id":"CVE-2026-79675","ts":1789369450046,"field":"severity","old":"high","new":"critical"},{"seq":189270,"id":"CVE-2026-79675","ts":1789368373734,"field":"cvss","old":"9.8","new":"8.1"},{"seq":189269,"id":"CVE-2026-79675","ts":1789368373734,"field":"severity","old":"critical","new":"high"},{"seq":188053,"id":"CVE-2026-79675","ts":1789365211899,"field":"cvss","old":"8.1","new":"9.8"},{"seq":188052,"id":"CVE-2026-79675","ts":1789365211899,"field":"severity","old":"high","new":"critical"},{"seq":186840,"id":"CVE-2026-79675","ts":1789363455220,"field":"cvss","old":"9.8","new":"8.1"},{"seq":186839,"id":"CVE-2026-79675","ts":1789363455220,"field":"severity","old":"critical","new":"high"},{"seq":185626,"id":"CVE-2026-79675","ts":1789361195633,"field":"cvss","old":"8.1","new":"9.8"},{"seq":185625,"id":"CVE-2026-79675","ts":1789361195633,"field":"severity","old":"high","new":"critical"},{"seq":184413,"id":"CVE-2026-79675","ts":1789358319213,"field":"cvss","old":"9.8","new":"8.1"},{"seq":184412,"id":"CVE-2026-79675","ts":1789358319213,"field":"severity","old":"critical","new":"high"},{"seq":182664,"id":"CVE-2026-79675","ts":1789354302962,"field":"cvss","old":"8.1","new":"9.8"},{"seq":182663,"id":"CVE-2026-79675","ts":1789354302962,"field":"severity","old":"high","new":"critical"},{"seq":181457,"id":"CVE-2026-79675","ts":1789353280347,"field":"cvss","old":"9.8","new":"8.1"},{"seq":181456,"id":"CVE-2026-79675","ts":1789353280347,"field":"severity","old":"critical","new":"high"},{"seq":180250,"id":"CVE-2026-79675","ts":1789350265794,"field":"cvss","old":"8.1","new":"9.8"},{"seq":180249,"id":"CVE-2026-79675","ts":1789350265794,"field":"severity","old":"high","new":"critical"},{"seq":179043,"id":"CVE-2026-79675","ts":1789348257344,"field":"cvss","old":"9.8","new":"8.1"},{"seq":179042,"id":"CVE-2026-79675","ts":1789348257344,"field":"severity","old":"critical","new":"high"},{"seq":177836,"id":"CVE-2026-79675","ts":1789346356281,"field":"cvss","old":"8.1","new":"9.8"},{"seq":177835,"id":"CVE-2026-79675","ts":1789346356281,"field":"severity","old":"high","new":"critical"},{"seq":176629,"id":"CVE-2026-79675","ts":1789343157536,"field":"cvss","old":"9.8","new":"8.1"},{"seq":176628,"id":"CVE-2026-79675","ts":1789343157536,"field":"severity","old":"critical","new":"high"},{"seq":174746,"id":"CVE-2026-79675","ts":1789334853444,"field":"cvss","old":"8.1","new":"9.8"},{"seq":174745,"id":"CVE-2026-79675","ts":1789334853444,"field":"severity","old":"high","new":"critical"},{"seq":173541,"id":"CVE-2026-79675","ts":1789333641541,"field":"cvss","old":"9.8","new":"8.1"},{"seq":173540,"id":"CVE-2026-79675","ts":1789333641541,"field":"severity","old":"critical","new":"high"},{"seq":172355,"id":"CVE-2026-79675","ts":1789331080920,"field":"cvss","old":"8.1","new":"9.8"},{"seq":172354,"id":"CVE-2026-79675","ts":1789331080920,"field":"severity","old":"high","new":"critical"},{"seq":171169,"id":"CVE-2026-79675","ts":1789328751075,"field":"cvss","old":"9.8","new":"8.1"},{"seq":171168,"id":"CVE-2026-79675","ts":1789328751075,"field":"severity","old":"critical","new":"high"}]}