The flaw in NLTK prior to version 3.10.3 permits an attacker to pass unvalidated JVM options to the per‑call options parameter in the java() function, which the underlying Stanford wrapper classes use. By injecting options such as -agentpath, -javaagent, or @argfile, an attacker can cause the JVM to load malicious agents or execute arbitrary code. The weakness is a classic command injection style vulnerability classified under CWE‑88.

The affected product is the NLTK library (nltk). All releases before version 3.10.3 are vulnerable; the issue was addressed in 3.10.3 and later.

The CVSS score of 9.3 places this vulnerability in the critical range, indicating a high potential for impact. The EPSS score is not available, but the lack of a KEV listing suggests the vulnerability is not yet widely exploited. The likely attack vector is local or any scenario where an attacker can run Python code that invokes nltk's java() function with malicious options. If unmitigated, an attacker could achieve arbitrary code execution on the affected host.