NLTK releases up to and including 3.9.2 contain a flaw in the StanfordSegmenter module that allows an attacker to supply or replace the Java .jar file used at import time. The module launches a Java subprocess with an unvalidated classpath, causing any malicious classes in the jar to execute with full privileges in the host JVM. This flaw falls under input validation weaknesses and improper restriction of execution path, facilitating the execution of arbitrary Java bytecode and equivalent remote code execution.

The Natural Language Toolkit version 3.9.2 and earlier are affected. The vulnerability applies to all installations that use the StanfordSegmenter component provided by nltk, irrespective of platform, as long as the jar files reside in the standard location.

The CVSS score of 10.0 reflects a perfect score for confidentiality, integrity, and availability loss. The EPSS score of less than 1 % indicates a very low current probability of exploitation, yet the vulnerability is severe and not listed in the CISA KEV catalog. Attackers would need to place a malicious jar in the npm-specified directory, which could occur through model poisoning, MITM attacks, or dependency poisoning. Once the vulnerable module is imported, the attacker would obtain full control over the JVM process, enabling arbitrary code execution on the host machine.