CVE-2026-63310

NLTK versions prior to 3.9.3 are vulnerable due to inadequate file integrity verification during package downloads, allowing attackers to exploit this weakness through man-in-the-middle attacks or DNS poisoning. This could lead to the extraction of malicious package contents, potentially compromising systems that utilize the library. Organizations using NLTK should prioritize updating to the latest version to mitigate the risk of exploitation.