CVE-2026-33230Medium· 6.1▾ Sunlit

nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)

A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attack…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score34/ 100 · Low

impact 33.6 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 20, 2026

Updated

Oct 15, 2026

CVSS

6.1

Vendor

Red Hat

Product

Red Hat Ansible Automation Platform 2

CWE

CWE-79

Depth score

34 · Low

EPSS

0.34% · p27

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 2.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 211 days

Mar 20, 2026Published
Disclosed via CSAF
Aug 2, 2026EPSS first tracked
0.3%
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 17, 2026EPSS peak
0.3% → 0.4%

Red Hat CWE-79 #csaf #vex #red-hat #osv #pip

Affected

Patched in

nltk 3.9.4

Full technical detail▾

Overview

A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The nltk.app.wordnet_app component contains a reflected cross-site scripting (XSS) vulnerability. A remote attacker can exploit this by crafting a malicious URL that injects arbitrary HTML or JavaScript code into the response page. This can lead to script execution in the browser for users running the local WordNet Browser server.

Vendor advisories

Red Hat VEX · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · vex

nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-10-15.

Affected:

Lightspeed Core
OpenShift Lightspeed
Red Hat Ansible Automation Platform 2
Red Hat OpenShift AI (RHOAI)

No fix planned:

Lightspeed Core
OpenShift Lightspeed
Red Hat Ansible Automation Platform 2
Red Hat OpenShift AI (RHOAI)

Remediation

Fix deferred

Workarounds / mitigations:

To mitigate this issue, avoid running the NLTK WordNet Browser server (nltk.app.wordnet_app) if it is not required. If the server must be run, users should exercise caution and avoid accessing untrusted or suspicious URLs while the application is active.

Package advisory (CVE-2026-33230)

Affected packages:

nltk < 3.9.4

Patched in:

nltk 3.9.4

Source: https://osv.dev/vulnerability/GHSA-gfwx-w7gr-fvh7

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#pip

← Back to feed