Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly names _tgrep_node_action in the nltk.tgrep module as the source of a Regular Expression Denial of Service (ReDoS) vulnerability. The core issue is the unvalidated compilation and execution of user-supplied regular expressions using Python's re module, which lacks built-in timeout mechanisms for catastrophic backtracking. The advisory text provides a clear code snippet of the vulnerable pattern: re.compile(node_lit). By fetching the current nltk/tgrep.py file from the repository's main branch (which is assumed to be patched to version 3.10.3 or later), it was observed that re.compile(node_lit) was replaced with redos.compile(node_lit). This confirms that _tgrep_node_action was indeed the vulnerable function, as it was directly responsible for processing the malicious input without adequate safeguards. The redos.compile function, introduced as part of the fix, provides the necessary timeout to prevent such ReDoS attacks. Although the direct commit for this specific fix was not found through the compare_two_commits tool, the clear description in the advisory and the observed change in the patched file content provide high confidence in identifying this function as vulnerable.
_tgrep_node_actionnltk/tgrep.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nltk | pip | <= 3.10.2 |