Repository navigation
NLTK dependency vulnerability #923
Description
My team's dependabot scanner picked up on a vulnerability (Critical level) from the nltk dependency. It's been fixed in 3.9.3 (draft PR here #922).
My team's dependabot scanner picked up on a vulnerability (Critical level) from the nltk dependency. It's been fixed in 3.9.3 (draft PR here #922).
Activity
devin-ai-integration commentedon Apr 1, 2026
Hi Okal (@okal), thank you for reporting this issue!
I've confirmed the vulnerability you're referencing: CVE-2025-14009 — a critical (CVSS 10.0) Zip Slip vulnerability in the NLTK downloader component (
nltk/downloader.py). The_unzip_iterfunction useszipfile.extractall()without path validation, which could allow an attacker to craft a malicious zip package that executes arbitrary code when downloaded and extracted by NLTK. The fix is available in nltk 3.9.3.There is also a second CVE on versions prior to 3.9.3: CVE-2026-0848 (Unsafe Dependency Resolution in the
StanfordSegmentermodule).I can see your PR #922 to bump
nltkto 3.9.3 — it looks like the right fix. That PR is currently closed with some CI failures; the Airbyte team will evaluate the best path to get this merged.This issue is already being tracked internally and has been escalated to the engineering team:
https://github.com/airbytehq/oncall/issues/11795
Need more help? Join Airbyte Community Slack for peer support, or if you're a Cloud customer, open a support ticket referencing this URL.
pnilan commentedon Sep 4, 2026
Fixed w/ merge of #968