Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nltk | pip | <= 3.10.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-jx89-3qg8-p2mr (a duplicate of GHSA-97qj-x29f-37w7), is an XML Entity Expansion (Billion Laughs) Denial of Service (DoS) in NLTK versions prior to 3.10.3. The core issue stems from the use of Python's standard xml.etree.ElementTree library for parsing XML without disabling the processing of entity declarations within Document Type Definitions (DTDs). This allows an attacker to craft a small XML payload that, when parsed, expands exponentially in memory, leading to excessive resource consumption and a denial of service.
The fix is implemented in commit e91789c9a043296ad04912ce171c22776d45963b, which introduces a new module nltk.xmlsec. This module provides hardened parse and fromstring functions that either leverage the defusedxml library (if installed) or fall back to a custom implementation using xml.parsers.expat to pre-scan XML for entity declarations and reject them before ElementTree processes the document. This ensures that malicious entity expansions are prevented.
My analysis focused on identifying all instances in the affected NLTK codebase where xml.etree.ElementTree.parse or xml.etree.ElementTree.fromstring were directly called without prior sanitization or entity-disabling mechanisms. The patch clearly shows these vulnerable calls being replaced with the new nltk.xmlsec.parse or nltk.xmlsec.fromstring functions. The identified functions are critical points where XML input is processed, making them direct targets for exploitation. Triggering any of these functions with a specially crafted XML document would lead to the vulnerability.
load_ace_filenltk/chunk/named_entity.py
Package.fromxmlnltk/downloader.py
Collection.fromxmlnltk/downloader.py
_find_collectionsnltk/downloader.py
_find_packagesnltk/downloader.py
ElementWrapper.__init__nltk/internals.py