Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-78682

NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 15.6%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2026-78682
  • Nltk » Nltk » Version: 2.0.1
    cpe:2.3:a:nltk:nltk:2.0.1
  • Nltk » Nltk » Version: 2.0.3
    cpe:2.3:a:nltk:nltk:2.0.3
  • Nltk » Nltk » Version: 2.0.4
    cpe:2.3:a:nltk:nltk:2.0.4
  • Nltk » Nltk » Version: 3.0.0
    cpe:2.3:a:nltk:nltk:3.0.0
  • Nltk » Nltk » Version: 3.0.1
    cpe:2.3:a:nltk:nltk:3.0.1
  • Nltk » Nltk » Version: 3.0.2
    cpe:2.3:a:nltk:nltk:3.0.2
  • Nltk » Nltk » Version: 3.0.3
    cpe:2.3:a:nltk:nltk:3.0.3
  • Nltk » Nltk » Version: 3.0.4
    cpe:2.3:a:nltk:nltk:3.0.4
  • Nltk » Nltk » Version: 3.0.5
    cpe:2.3:a:nltk:nltk:3.0.5
  • Nltk » Nltk » Version: 3.1
    cpe:2.3:a:nltk:nltk:3.1
  • Nltk » Nltk » Version: 3.10.0
    cpe:2.3:a:nltk:nltk:3.10.0
  • Nltk » Nltk » Version: 3.10.1
    cpe:2.3:a:nltk:nltk:3.10.1
  • Nltk » Nltk » Version: 3.10.2
    cpe:2.3:a:nltk:nltk:3.10.2
  • Nltk » Nltk » Version: 3.2
    cpe:2.3:a:nltk:nltk:3.2
  • Nltk » Nltk » Version: 3.2.1
    cpe:2.3:a:nltk:nltk:3.2.1
  • Nltk » Nltk » Version: 3.2.2
    cpe:2.3:a:nltk:nltk:3.2.2
  • Nltk » Nltk » Version: 3.2.3
    cpe:2.3:a:nltk:nltk:3.2.3
  • Nltk » Nltk » Version: 3.2.4
    cpe:2.3:a:nltk:nltk:3.2.4
  • Nltk » Nltk » Version: 3.2.5
    cpe:2.3:a:nltk:nltk:3.2.5
  • Nltk » Nltk » Version: 3.3
    cpe:2.3:a:nltk:nltk:3.3
  • Nltk » Nltk » Version: 3.4
    cpe:2.3:a:nltk:nltk:3.4
  • Nltk » Nltk » Version: 3.4.1
    cpe:2.3:a:nltk:nltk:3.4.1
  • Nltk » Nltk » Version: 3.4.3
    cpe:2.3:a:nltk:nltk:3.4.3
  • Nltk » Nltk » Version: 3.4.4
    cpe:2.3:a:nltk:nltk:3.4.4
  • Nltk » Nltk » Version: 3.4.5
    cpe:2.3:a:nltk:nltk:3.4.5
  • Nltk » Nltk » Version: 3.5
    cpe:2.3:a:nltk:nltk:3.5
  • Nltk » Nltk » Version: 3.6
    cpe:2.3:a:nltk:nltk:3.6
  • Nltk » Nltk » Version: 3.6.1
    cpe:2.3:a:nltk:nltk:3.6.1
  • Nltk » Nltk » Version: 3.6.2
    cpe:2.3:a:nltk:nltk:3.6.2
  • Nltk » Nltk » Version: 3.6.3
    cpe:2.3:a:nltk:nltk:3.6.3
  • Nltk » Nltk » Version: 3.6.4
    cpe:2.3:a:nltk:nltk:3.6.4
  • Nltk » Nltk » Version: 3.6.5
    cpe:2.3:a:nltk:nltk:3.6.5
  • Nltk » Nltk » Version: 3.6.6
    cpe:2.3:a:nltk:nltk:3.6.6
  • Nltk » Nltk » Version: 3.6.7
    cpe:2.3:a:nltk:nltk:3.6.7
  • Nltk » Nltk » Version: 3.7
    cpe:2.3:a:nltk:nltk:3.7
  • Nltk » Nltk » Version: 3.8
    cpe:2.3:a:nltk:nltk:3.8
  • Nltk » Nltk » Version: 3.8.1
    cpe:2.3:a:nltk:nltk:3.8.1
  • Nltk » Nltk » Version: 3.9
    cpe:2.3:a:nltk:nltk:3.9
  • Nltk » Nltk » Version: 3.9.1
    cpe:2.3:a:nltk:nltk:3.9.1
  • Nltk » Nltk » Version: 3.9.2
    cpe:2.3:a:nltk:nltk:3.9.2
  • Nltk » Nltk » Version: 3.9.3
    cpe:2.3:a:nltk:nltk:3.9.3
  • Nltk » Nltk » Version: 3.9.4
    cpe:2.3:a:nltk:nltk:3.9.4


Products
Pricing
Contact Us

Shodan ® - All rights reserved