NLTK for Python versions 3.9.3 and earlier provide five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) that accept user‑controllable JAR paths. The classes invoke a java() helper which uses subprocess.Popen() without verifying the integrity of the supplied JAR, exposing weaknesses identified as CWE‑347 and CWE‑94. An attacker can supply a malicious JAR that executes with the privileges of the NLTK process, resulting in arbitrary code execution.

The flaw affects all releases of the Python NLTK package up to and including 3.9.3, specifically the five Stanford interface classes mentioned above. The vulnerability resides in the open‑source nltk/nltk repository and can be triggered whenever those classes are instantiated with externally supplied JAR paths.

The CVSS score of 7.8 signals high severity, while the EPSS score of <1% indicates a very low likelihood of exploitation in the wild. The flaw is not catalogued in CISA’s KEV list. An attacker can exploit the vulnerability by providing a malicious JAR to any of the vulnerable classes. This can occur in local development, during data ingestion from untrusted sources, or in production code that loads external JAR files that are not authenticated. The likely attack vector is the execution of untrusted JAR code through the Stanford interfaces, enabling the attacker to run arbitrary code with the rights of the NLTK process.