NLTK collocations.py Command Injection Vulnerability (CWE-95) PoC and Fix

Vulnerability Overview A command injection vulnerability exists in the file of the NLTK library. This vulnerability arises because the function is used to select a scoring function based on command-line arguments. Specifically, and are entirely controlled by the user executing the command, leading to arbitrary code execution. Scope of Impact Local CLI: The vulnerability resides in the local Command Line Interface (CLI) and does not involve network components. Widely Deployed NLP Library: NLTK is a widely used Natural Language Processing (NLP) library. If is invoked with externally derived arguments (e.g., via wrapper scripts, Jupyter environments, build pipelines, etc.), the pathway may pose a risk. Assumptions Regarding Execution Context: The code assumes a fixed execution context; however, using on user-controlled strings can actually lead to arbitrary code execution. Remediation Replace with to prevent arbitrary code execution. The specific remediation code is as follows: Proof of Concept (POC) Code Sample Output Disclosure Timeline November 14, 2025: Reported to huntr.dev November 14, 2025: Huntr marked as potentially out of scope (Local CLI, no network components) No CVE Assigned: As of publication References CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') NLTK: https://www.nltk.org/ Python Security: https://peps.python.org/pep-0665/ Related Content CVE-2026-0558: Unauthenticated File Upload in LoilMS SQL Injection Vulnerability: Security Issue with Function in GeoPandas SSRF in LoilMS Export: CVE-2026-0560 --- Summary: A command injection vulnerability exists in the file of the NLTK library, allowing arbitrary code execution via the function. The remediation involves replacing with to mitigate security risks.

Goal Reached Thanks to every supporter — we hit 100%!

NLTK collocations.py Command Injection Vulnerability (CWE-95) PoC and Fix