---
id: CVE-2026-33230
title: >-
  nltk: NLTK: Script execution via reflected cross-site scripting in WordNet
  Browser (CVE-2026-33230)
summary: >-
  A flaw was found in NLTK (Natural Language Toolkit), a suite of open source
  Python modules for Natural Language Processing. The `nltk.app.wordnet_app`
  component contains a reflected cross-site scripting (XSS) vulnerability. A
  remote attack…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe: CWE-79
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
affected:
  - lightspeed_core
  - openshift_lightspeed
  - ansible_automation_platform 2
  - openshift_ai_rhoai
patched:
  - nltk 3.9.4
published: '2026-03-20'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:35:21+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33230.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33230.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-33230'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2449825'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-33230'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33230'
  - url: >-
      https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
  - url: >-
      https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7'
  - url: 'https://github.com/nltk/nltk'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00336
epssPercentile: 0.27181
aliases:
  - GHSA-gfwx-w7gr-fvh7
  - PYSEC-2026-2235
ecosystem: pip
ingestedAt: '2026-07-13T18:57:58.385Z'
---

## Overview

A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attacker can exploit this by crafting a malicious URL that injects arbitrary HTML or JavaScript code into the response page. This can lead to script execution in the browser for users running the local WordNet Browser server.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33230.json)

**nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser** — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-10-15.

Affected:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

Workarounds / mitigations:

- To mitigate this issue, avoid running the NLTK WordNet Browser server (`nltk.app.wordnet_app`) if it is not required. If the server must be run, users should exercise caution and avoid accessing untrusted or suspicious URLs while the application is active.

## Package advisory (CVE-2026-33230)

Affected packages:

- `nltk < 3.9.4`

Patched in:

- `nltk 3.9.4`

Source: https://osv.dev/vulnerability/GHSA-gfwx-w7gr-fvh7