Security Advisory
CVE-2026-63310
CVE vulnerability detail - eXtreme Datacenter Security Operations
Description
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.