This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-79675 →

DEBIAN-CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject da...

Original description

The description as published by the source.

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-1"}]}]

References

advisory security-tracker.debian.org