Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-24 | 2 | Disclosure2 |
| 2026-07-25 | 2 | Disclosure1Patch1 |
| 2026-09-30 | 1 | Patch1 |
Found command injection in NLTK via eval(). Arbitrary code execution possible and tracked as CVE-2025-71408 https://aydinnyunus.github.io/2026/06/07/command-injection-nltk-collocations-eval/ #security #python #bugbounty #appsec
Post summary
A security researcher disclosed a command injection flaw in NLTK that allows arbitrary code execution, linked to a blog post identifying CVE-2025-71408.
🚨 HIGH: CVE-2025-71408 (CVSS 7.8) NLTK <3.9.3 eval injection in collocations module allows arbitrary code execution via command-line args. Attackers can execute OS commands. Mitigation: Update to NLTK 3.9.3+ #CVE #Vulnerability #PatchNow https://t.co/g3HCuAkB3i
Post summary
The tweet discloses CVE‑2025‑71408, a CVSS 7.8 eval‑injection flaw in NLTK versions before 3.9.3 that enables arbitrary code execution, and advises updating to NLTK 3.9.3+ as the mitigation.
🚨High - NLTK eval Injection via http://collocations.py Command-Line Arguments (CVE-2025-71408) In NLTK before 3.9.3, running the collocations module directly passes command-line arguments straight into eval() as suffixes of BigramAssocMeasures, with no allowlist or sanitization. An attacker who controls those arguments can supply a Python expression that escapes the attribute lookup and executes arbitrary code, including OS commands via the os module. The vector is local and specific to invoking http://collocations.py as a script with attacker-influenced arguments - normal import nltk usage isn't affected - so real exposure is limited to tools/pipelines that forward untrusted input into that command line. Where that exists, it's full code execution. CVSS 8.5. 👉Upgrade NLTK to 3.9.3.
Post summary
A high‑severity eval injection flaw (CVE‑2025‑71408) in NLTK's collocations command‑line allows local code execution; the fix is to update to NLTK 3.9.3.
🚨*CVE* CVE-2025-71408 NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls com… https://www.cve.org/CVERecord?id=CVE-2025-71408 ----- Traducción: CVE-2025-71408 NLT… http://infoflow.cloud`
Post summary
The post announces CVE-2025-71408, describing an eval injection flaw in NLTK and linking to the official CVE record, but provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2025-71408 NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls com… https://www.cve.org/CVERecord?id=CVE-2025-71408
Post summary
The text reports CVE-2025-71408, detailing an eval injection vulnerability in NLTK's collocations module, but it does not provide a PoC, exploit code, patch, or claim of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nltk | nltk | - | - | - |