CVE-2025-14009

{"id": "CVE-2025-14009", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "published": "2026-02-18T18:24:19.410", "references": [{"url": "https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms."}, {"lang": "es", "value": "Una vulnerabilidad cr\u00edtica existe en el componente de descarga de NLTK de nltk/nltk, que afecta a todas las versiones. La funci\u00f3n _unzip_iter en nltk/downloader.py utiliza zipfile.extractall() sin realizar validaci\u00f3n de rutas o comprobaciones de seguridad. Esto permite a los atacantes crear paquetes zip maliciosos que, al ser descargados y extra\u00eddos por NLTK, pueden ejecutar c\u00f3digo arbitrario. La vulnerabilidad surge porque NLTK asume que todos los paquetes descargados son de confianza y los extrae sin validaci\u00f3n. Si un paquete malicioso contiene archivos Python, como __init__.py, estos archivos se ejecutan autom\u00e1ticamente al importarlos, lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. Este problema puede resultar en un compromiso total del sistema, incluyendo acceso al sistema de archivos, acceso a la red y posibles mecanismos de persistencia."}], "lastModified": "2026-03-06T21:23:46.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22061B61-87EB-4006-8152-23CD3514C2AE", "versionEndExcluding": "3.9.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}