A critical remote code execution vulnerability in the NLTK downloader allows unauthenticated attackers to achieve full system compromise by tricking the library into extracting malicious archives.

This flaw exists in the _unzip_iter function within nltk/downloader.py, which utilizes zipfile.extractall() without proper path sanitization. An unauthenticated attacker can provide a crafted zip package containing malicious Python files (e.g., __init__.py) that are executed automatically upon import.

A successful exploit grants an attacker full control over the host environment, including the ability to read sensitive data, pivot through the network, and establish persistent access. The CVSS score of 10.0 reflects the maximum possible severity, as the vulnerability requires no authentication and results in a total loss of confidentiality, integrity, and availability.

Immediate Action: Update NLTK to the latest patched version immediately. If an update is not available, disable the use of the NLTK downloader for untrusted or external package sources.

Proactive Monitoring: Monitor filesystem activity for unexpected file creations or modifications within Python library directories and review network logs for outbound connections from the NLTK downloader.

Compensating Controls: Implement strict network egress filtering to ensure the downloader only communicates with verified, trusted NLTK mirror repositories.

Public Exploit Available: No

The severity of this vulnerability cannot be overstated given its CVSS 10.0 rating and the potential for complete system takeover. Organizations utilizing NLTK must prioritize updating the library across all development and production environments to mitigate the risk of remote code execution.