{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "3.9.3"
              }
            ],
            "source": [
              "DESCRIPTION",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4154eb85e832f266660a09286c7e37e308292284"
            },
            {
              "fixed": "66f14096d952ec8f04934f515e027534bd4eb0ac"
            }
          ],
          "repo": "https://github.com/nltk/nltk",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-95"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71408.json"
  },
  "details": "NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.",
  "id": "CVE-2025-71408",
  "modified": "2026-07-28T03:55:52.200128114Z",
  "published": "2026-07-24T21:07:49.610Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71408.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71408"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/nltk-eval-injection-via-collocations-py-command-line-arguments"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nltk/nltk/commit/66f14096d952ec8f04934f515e027534bd4eb0ac"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nltk/nltk/pull/3465"
    },
    {
      "type": "FIX",
      "url": "https://github.com/nltk/nltk/releases/tag/3.9.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nltk/nltk"
    },
    {
      "type": "EVIDENCE",
      "url": "https://aydinnyunus.github.io/2026/06/07/command-injection-nltk-collocations-eval/"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NLTK \u003c 3.9.3 Eval Injection via collocations.py Command-Line Arguments"
}