CVE-2026-33230 - Vulnerability Analysis

Overview

NLTK <= 3.9.3 contains a reflected XSS caused by unescaped attacker-controlled 'word' data in the lookup_... route of nltk.app.wordnet_app, letting remote attackers execute scripts in the browser, exploit requires running the local WordNet Browser server.

Severity & Score

Impact

Attackers can execute arbitrary scripts in the browser of users running the local WordNet Browser server, leading to potential session hijacking or data theft.

Mitigation

Update to a version including commit 1c3f799607eeb088cab2491dcf806ae83c29ad8f or later.

References

• https://github.com/nltk/nltk/commit/1c3f799607eeb088cab2491dcf806ae83c29ad8f
• https://github.com/nltk/nltk/commit/40d0bc1d484a3458d6a63ecb5ba4957ab16ba14e
• https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner