A critical vulnerability in the NLTK library, affecting all versions prior to 3.9.3, allows for the execution of untrusted code due to missing integrity verification during downloads.

The vulnerability is identified as a download of code without integrity check (CWE-494). It allows an unauthenticated, remote attacker to potentially substitute legitimate library components with malicious versions, resulting in full system compromise.

With a CVSS score of 7.1, this vulnerability poses a severe risk to any environment utilizing the NLTK library for data processing. Successful exploitation could lead to full system compromise, data theft, and unauthorized access to the underlying host system.

Immediate Action: Update the NLTK library to version 3.9.3 or later to ensure all downloaded components are cryptographically verified.

Proactive Monitoring: Inspect application environments for unauthorized libraries or unexpected outbound network connections initiated by the application.

Compensating Controls: Use a private, trusted repository for all package dependencies and restrict outbound internet access for servers running NLTK to prevent unauthorized downloads.

Public Exploit Available: No (exploit_available: false)

The absence of integrity verification in NLTK represents a major security oversight. Organizations must upgrade to version 3.9.3 immediately to prevent potential remote code execution via malicious package injection.