Vulnerability Description
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nltk | Nltk | < 3.9.3 |
Related Weaknesses (CWE)
References
- https://aydinnyunus.github.io/2026/06/07/command-injection-nltk-collocations-evaExploitPress/Media CoverageThird Party Advisory
- https://github.com/nltk/nltk/commit/66f14096d952ec8f04934f515e027534bd4eb0acPatch
- https://github.com/nltk/nltk/pull/3465Issue TrackingPatch
- https://github.com/nltk/nltk/releases/tag/3.9.3Release Notes
- https://www.vulncheck.com/advisories/nltk-eval-injection-via-collocations-py-comPatchThird Party Advisory
FAQ
What is CVE-2025-71408?
CVE-2025-71408 is a vulnerability with a CVSS score of 7.8 (HIGH). NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arb...
How severe is CVE-2025-71408?
CVE-2025-71408 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-71408?
Check the references section above for vendor advisories and patch information. Affected products include: Nltk Nltk.