{"apiVersion":"1.0","identifier":"CVE-2026-63310","description":"NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.","publishedAt":"2026-08-22T15:16:19","lastModifiedAt":"2026-08-24T20:16:55","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63310","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","epssProbability":0.0011,"riskScore":0.72,"affectedProduct":"nltk","affectedVersions":"<3.9.3","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-63310","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-63310","en":"https://www.redsauce.net/en/cves/CVE-2026-63310","fr":"https://www.redsauce.net/fr/cves/CVE-2026-63310","pt":"https://www.redsauce.net/pt/cves/CVE-2026-63310","de":"https://www.redsauce.net/de/cves/CVE-2026-63310","sk":"https://www.redsauce.net/sk/cves/CVE-2026-63310","el":"https://www.redsauce.net/el/cves/CVE-2026-63310"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-63310"}}