A flaw in the nltk downloader allows a package to write files into shared namespaces such as corpora/ and taggers/ without isolation, and the integrity check occurs only after extraction. This permits one package to overwrite another package’s trusted resources, injecting malicious or altered data that is immediately usable through normal NLTK APIs. The injected resources can alter text‑processing results, affect downstream machine learning pipelines, and compromise the reproducibility of experiments that rely on stable corpus and tagger contents.

The vulnerability is present in nltk/nltk up to and including version 3.9.4. Any environment that loads these versions of the library, whether in a local script, a server application, or a data‑science notebook, is potentially impacted. No specific operating system or deployment model is mentioned, so the issue applies broadly wherever the vulnerable library is installed.

With a CVSS score of 5.3 the risk is moderate; the EPSS score is not listed, and the vulnerability is not in the CISA KEV catalog. The design flaw implies that an attacker who can influence the package download process—for example, by introducing a malicious package to an untrusted or compromised repository—can replace trusted model or corpus files. The changes persist across interpreter restarts, so the impact is durable. The attack vector is inferred to be local or via compromised package source rather than from an external network port.