Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-78680 →
DEBIAN-CVE-2026-78680
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._rep...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.repr_svg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-1"}]}]
Références
- advisory security-tracker.debian.org