Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nltk | pip | < 3.9.3 | 3.9.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the nltk/collocations.py script, specifically within the main execution block that is triggered when the file is run directly from the command line. The analysis of the provided patch in commit 66f14096d952ec8f04934f515e027534bd4eb0ac reveals that command-line arguments are concatenated into a string and passed directly to the eval() function. This constitutes an 'Eval Injection' vulnerability. An attacker can provide a specially crafted argument to execute arbitrary Python code on the system where the NLTK library is used. The patch replaces the unsafe eval() call with getattr(), which safely retrieves an attribute from the BigramAssocMeasures class without executing code, thus mitigating the vulnerability. The vulnerable code is not within a standard function but at the module's top level, which is typically identified as <module> in Python profilers.
<module>nltk/collocations.py