CVE-2026-128134

A local user could substitute the renderer used by NLTK dependency graphs

NLTK project · Natural Language Toolkit dependency graph renderer

First documented disclosure · Review checkpoint

Summary

The rendering path invoked a Graphviz executable found on the search path without NLTK’s trusted-program checks. The substituted executable could run with the rendering user’s permissions.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The rendering path invoked a Graphviz executable found on the search path without NLTK’s trusted-program checks.

Conditions required

A local user could write into a directory on a POSIX user’s executable search path and the user rendered a graph.

Potential impact

The substituted executable could run with the rendering user’s permissions.

Affected versions and configurations

Through 3.10.3.

Fix and mitigation status

3.10.4.

Practical next steps

Upgrade NLTK to 3.10.4 or later. Remove writable directories from graph-rendering workers’ executable search paths.

Operating lesson

Use the same executable trust checks on visualization paths as on other subprocess calls.

Evidence and limits

The CVE record was published on 2026-11-13.

Sources