Review reviewHigh

CVE-2025-14009

nltk nltk/nltk, Red Hat OpenShift AI 2.25, OpenShift Lightspeed

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import,...

CVSS: 8.8
EPSS: 0.79%
CISA KEV: Not listed
Published: 2026.02.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.79%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: nltk nltk/nltk, Red Hat OpenShift AI 2.25, OpenShift Lightspeed
Affected versions: >= unspecified <= latest, < 3.9.3
Fixed versions: 3.9.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that nltk nltk/nltk, Red Hat OpenShift AI 2.25, OpenShift Lightspeed and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-94