CVE-2026-78680 - NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

Back Back to CVE browser

HIGH

NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary

Published Aug 25, 2026

8.5

HIGH

CVSS 4.0

EPSS 0.18%

Description

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.

Affected products

Vendor Nltk Product Nltk Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.10.3
- Version
  3.10.3
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nltk

unaffected

Version	Status	Constraints
0	affected	<3.10.3
3.10.3	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-426

CWE-427

References (7)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65226		Advisory
https://github.com/advisories/GHSA-6hwm-xvph-95vm		Advisory
https://github.com/nltk/nltk/commit/1a3cd1764ab3deb084fb66d0ffb4873717659538
https://github.com/nltk/nltk/releases/tag/v3.10.3
https://github.com/nltk/nltk/security/advisories/GHSA-6hwm-xvph-95vm		exploitvendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-78680
https://www.vulncheck.com/advisories/nltk-before-arbitrary-code-execution-via-graphviz-dot-binary		third-party-advisory