---
title: "CVE-2025-14009: NLTK has a Zip Slip Vulnerability"
url: https://erroneo.us/security/cve/CVE-2025-14009/
description: "CVE-2025-14009 (nltk (PyPI)): A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-02-18
date_modified: 2026-07-15
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-14009"
kev: false
cvss: 8.8
epss: 0.01036
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-14009: NLTK has a Zip Slip Vulnerability

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 1.0% , percentile 64: FIRST’s model estimates a 1.0% chance of exploitation activity in the next 30 days, higher than 64% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes nltk (PyPI) <= 3.9.2, fixed in 3.9.3 . Check your lockfile, including transitive dependencies.

## What it is

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as init.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.

## Affected packages

- PyPI `nltk` <= 3.9.2 → fixed: 3.9.3

## Affected products (CVE record)

- nltk nltk/nltk: unspecified <= latest

## Severity

- @huntr_ai CVSS 3.0: 10 `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
- redhat-SADP CVSS 3.1: 8.8 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
- GitHub CVSS 3.1: 10.0 `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.04% probability of exploitation activity in the next 30 days; percentile 64.

## Sources

- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10184)
- [GitHub Advisory GHSA-7p94-766c-hgjp](https://github.com/advisories/GHSA-7p94-766c-hgjp)
- [CVE.org record CVE-2025-14009](https://www.cve.org/CVERecord?id=CVE-2025-14009)
- [NVD entry CVE-2025-14009](https://nvd.nist.gov/vuln/detail/CVE-2025-14009)
- [huntr.com](https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2025-14009)
- [RHBZ#2440724](https://bugzilla.redhat.com/show_bug.cgi?id=2440724)
- [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14009.json)
- [github.com](https://github.com/nltk/nltk/pull/3468)
- [github.com](https://github.com/nltk/nltk/commit/1056b323af6462455571302e766b67cf300aea18)
- [github.com](https://github.com/nltk/nltk/blob/4154eb85e832f266660a09286c7e37e308292284/ChangeLog#L1)
- [github.com](https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-96.yaml)

---
Source page: https://erroneo.us/security/cve/CVE-2025-14009/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt