THREAT OPS › Threat News › [GHSA] GHSA-5wp5-5229-5g6q (medium) — NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
[GHSA] GHSA-5wp5-5229-5g6q (medium) — NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
GHSA-5wp5-5229-5g6q Severity: medium CVE: CVE-2026-12259
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction.
The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replace(tmp_filepath, filepath) moves it to the f
MITRE ATT&CK techniques
- Malicious PackageAML.T0011.001
Indicators of compromise
- CVE-2026-12259cve
- CVE-2024-39705cve
- CVE-2025-14009cve
Original source: https://github.com/advisories/GHSA-5wp5-5229-5g6q