CVE-2026-79675 — NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attacker…
Published: 2026-08-25 · CVSS: 9.3 · CVSS 4.0
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7