CVE-2026-78680: Nltk

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.

Affected products

• Nltk Nltk: before 3.10.3 (fixed in 3.10.3)

Published 2026-08-25. Last modified 2026-09-23.