DEBIAN-CVE-2025-14009
Record from OSV · Published February 18, 2026
A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| nltk | Debian:14 | 3.9.3-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | nltk | 0, 3.10.0-1, 3.10.1-1 |
| Debian:13 | nltk | 3.9.3-1, 3.10.3-1, 3.9.1-2 |
| Debian:14 | nltk | 3.9.1-2, 3.9.2-1, 0 |
Timeline
- Feb 18, 2026 CVE Published
- Sep 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2025-14009
vulnetix vdb fixes DEBIAN-CVE-2025-14009Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2025-14009/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart