FKIE_CVE-2025-14009

Vulnerability from fkie_nvd - Published: 2026-02-18 18:24 - Updated: 2026-02-19 15:53
Severity ?
10.0 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.
References
security@huntr.devhttps://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4
134c704f-9b21-4f2e-91b3-4a467353bcc0https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad cr\u00edtica existe en el componente de descarga de NLTK de nltk/nltk, que afecta a todas las versiones. La funci\u00f3n _unzip_iter en nltk/downloader.py utiliza zipfile.extractall() sin realizar validaci\u00f3n de rutas o comprobaciones de seguridad. Esto permite a los atacantes crear paquetes zip maliciosos que, al ser descargados y extra\u00eddos por NLTK, pueden ejecutar c\u00f3digo arbitrario. La vulnerabilidad surge porque NLTK asume que todos los paquetes descargados son de confianza y los extrae sin validaci\u00f3n. Si un paquete malicioso contiene archivos Python, como __init__.py, estos archivos se ejecutan autom\u00e1ticamente al importarlos, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. Este problema puede resultar en un compromiso total del sistema, incluyendo acceso al sistema de archivos, acceso a la red y posibles mecanismos de persistencia."
    }
  ],
  "id": "CVE-2025-14009",
  "lastModified": "2026-02-19T15:53:02.850",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-18T18:24:19.410",
  "references": [
    {
      "source": "security@huntr.dev",
      "url": "https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.