Outdated nltk dependency contains CVE-2025-14009 #957

Activity

1. devin-ai-integration commented on Apr 1, 2026

   

   devin-ai-integrationBot

   on Apr 1, 2026 – with Devin.ai Integration

   Contributor

   More actions

   Hi Yong Zheng (@MonkeyCanCode), thank you for reporting this issue!

   You are correct that nltk is currently pinned at 3.9.1 in the Airbyte Python CDK, which is affected by CVE-2025-14009 — a critical (CVSS 10.0) Zip Slip vulnerability in the NLTK downloader component. The fix is available in nltk version 3.9.3.

   Good news — this is already being actively addressed:

   • A fix PR has been opened to bump nltk from 3.9.1 to 3.9.3: fix(deps): bump nltk from 3.9.1 to 3.9.3 to address CVE-2025-14009 #964
   • This is tracked internally and the fix will propagate to all affected connectors once the CDK release is published.

   Practical risk context: While the CVSS score is 10.0, the actual risk to Airbyte users is low in practice. The vulnerability is in the nltk.download() code path, which downloads data from the official NLTK data server inside isolated connector containers. Exploitation would require serving a malicious NLTK data package, which is unlikely in the Airbyte runtime environment. That said, the version bump is important for security compliance and scanning.

   This issue is being tracked internally: https://github.com/airbytehq/oncall/issues/11795

   ---

   Need more help? Join Airbyte Community Slack for peer support, or if you're a Cloud customer, open a support ticket referencing this URL.

   👍React with 👍1Reacted by Yong Zheng
2. Patrick Nilan (pnilan)

   added

   communityPRs and issues from community contributorsPRs and issues from community contributors

   on Jul 31, 2026
3. pnilan commented on Sep 4, 2026

   

   Patrick Nilan (pnilan)

   on Sep 4, 2026

   Collaborator

   More actions

   Fixed w/ merge of #968
4. Patrick Nilan (pnilan)

   closed this as completedon Sep 4, 2026