A critical command injection vulnerability in NLTK allows for arbitrary code execution when processing untrusted input.

The software performs improper neutralization of directives in dynamically evaluated code, categorized as CWE-95. This vulnerability allows an authenticated local attacker to perform command injection via specific command-line arguments.

The CVSS score of 7.8 underscores the severe potential for full system compromise if the library is utilized in an environment processing untrusted user input. An attacker successfully exploiting this flaw could achieve arbitrary command execution with the privileges of the application, leading to total loss of system confidentiality, integrity, and availability.

Immediate Action: Update the NLTK library to version 3.9.3 or later to remediate the unsafe use of dynamic evaluation functions.

Proactive Monitoring: Monitor application execution logs for evidence of unexpected system calls or shell commands originating from the NLTK library process.

Compensating Controls: Ensure that any input passed to NLTK functions is rigorously sanitized and validated against a strict allowlist to prevent the injection of malicious directives.

Public Exploit Available: No (unknown)

Given the high impact associated with arbitrary code execution, updating NLTK to version 3.9.3 must be treated as a high-priority task. Organizations utilizing this library for natural language processing should verify their dependencies and apply the update to neutralize the risk of command injection.