{"id":"CVE-2026-33230","title":"nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)","summary":"A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attack…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-79","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["lightspeed_core","openshift_lightspeed","ansible_automation_platform 2","openshift_ai_rhoai"],"patched":["nltk 3.9.4"],"published":"2026-03-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:35:21+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33230.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33230.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33230"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449825"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33230"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33230"},{"url":"https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f"},{"url":"https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e"},{"url":"https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7"},{"url":"https://github.com/nltk/nltk"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00336,"epssPercentile":0.26882,"aliases":["GHSA-gfwx-w7gr-fvh7","PYSEC-2026-2235"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:58.385Z","slug":"CVE-2026-33230","body":"## Overview\n\nA flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attacker can exploit this by crafting a malicious URL that injects arbitrary HTML or JavaScript code into the response page. This can lead to script execution in the browser for users running the local WordNet Browser server.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33230.json)\n\n**nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser** — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-10-15.\n\nAffected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, avoid running the NLTK WordNet Browser server (`nltk.app.wordnet_app`) if it is not required. If the server must be run, users should exercise caution and avoid accessing untrusted or suspicious URLs while the application is active.\n\n## Package advisory (CVE-2026-33230)\n\nAffected packages:\n\n- `nltk < 3.9.4`\n\nPatched in:\n\n- `nltk 3.9.4`\n\nSource: https://osv.dev/vulnerability/GHSA-gfwx-w7gr-fvh7","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}