The flaw in nltk 3.9.4 allows the downloader to extract a package before validating its checksum, permitting an attacker who controls a mirror or proxy to replace the package contents. If the application accepts the extracted corpus or model, the attacker can inject arbitrary data or code into downstream processing, effectively delivering malicious content that is trusted by users. This weakness is captured by CWE‑354 and CWE‑494.

Python applications that import and use nltk, specifically those running version 3.9.4, are impacted. Versions that have already incorporated checksum validation prior to extraction are not affected, and projects that do not use nltk are unaffected.

With a CVSS score of 5.3 the vulnerability is moderate, and its EPSS of <1% suggests a low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. An attacker can exploit the flaw only when the application downloads packages from untrusted mirrors or when a mirror is compromised. Because no official patch or workaround is published, remediation relies on upgrading the library or implementing manual integrity checks; the risk also depends on the organization’s dependency‑management practices.