Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-78680, stems from NLTK's failure to use validated absolute paths when invoking the Graphviz 'dot' binary. This allowed for arbitrary code execution by an attacker placing a malicious 'dot' binary in the search path or current working directory. The provided commit 1a3cd1764ab3deb084fb66d0ffb4873717659538 directly addresses this issue.
Upon analyzing the commit, two specific locations were identified where the 'dot' binary was invoked insecurely:
nltk/parse/dependencygraph.py in the dot2img function: The original code called find_binary("dot") but then proceeded to use ["dot", ...] in subprocess.run. This effectively discarded the security benefit of find_binary (which resolves to a trusted absolute path) and allowed the system to resolve 'dot' via the PATH or current working directory, making it susceptible to a malicious binary.
nltk/translate/api.py in the AlignedSent._repr_svg_ method: This method directly used ["dot", ...] in subprocess.Popen without any prior call to find_binary or path validation. This was a direct exposure to the untrusted search path vulnerability.
The patch explicitly modifies these two locations to store the result of find_binary("dot") into a variable (e.g., dot_binary) and then use this variable in the subprocess.run or subprocess.Popen calls. This ensures that the absolute, validated path to the legitimate Graphviz 'dot' binary is used, preventing the execution of a malicious binary. Therefore, the dot2img function and the AlignedSent._repr_svg_ method are the vulnerable functions that would appear in a runtime profile during exploitation.
dot2imgnltk/parse/dependencygraph.py
AlignedSent._repr_svg_nltk/translate/api.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nltk | pip | <= 3.10.2 | 3.10.3 |