6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33230

CVE-2026-33230: nltk Vulnerable to Cross-site Scripting

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnet_app contains a reflected cross-site scripting issue in the lookup_... route. A crafted lookup_<payload> URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without escaping. This impacts users running the local WordNet Browser server and can lead to script execution in the browser origin of that application. Commit 1c3f799607eeb088cab2491dcf806ae83c29ad8f fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33230

CVE-2026-33230:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nltk	pip	<= 3.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue within the nltk.app.wordnet_app module of the NLTK library. The root cause lies in the page_from_reference function, which is responsible for generating HTML content for the WordNet browser application. When a user makes a request to a lookup_ URL, the provided input is processed and eventually passed as the word parameter to page_from_reference. The vulnerability is triggered when this word is not found in the WordNet dictionary. In this case, the function constructs an error message that includes the user-provided word directly in the HTML body without any sanitization or escaping. The patch applied in commit 1c3f799607eeb088cab2491dcf806ae83c29ad8f confirms this by adding html.escape() to the word variable before it is rendered. Therefore, page_from_reference is the precise location of the vulnerability, as it is the function that directly handles the unsafe input and generates the vulnerable output.

Vulnerable functions

page_from_reference

nltk/app/wordnet_app.py

The function `page_from_reference` takes a 'word' from a user-controlled URL. If this word is not found in the dictionary, it is embedded directly into the HTML response without being escaped. This allows an attacker to inject malicious HTML and JavaScript, leading to a reflected Cross-Site Scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.