CVE-2026-128134

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

Copy to clipboard

  <vuln vid="FIXME (make newentry)">
    <topic>py312-nltk -- FIXME</topic>
    <affects>
      <package>
	<name>py312-nltk</name>
	<range><lt>3.10.4,2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-128134: NLTK (Natural Language Toolkit) is a suite of open
	  source Python modules, data sets, and tutorials supporting research
	  and development in Natural Language Processing. Prior to 3.10.4,
	  nltk.parse.dependencygraph.dot2img resolves the Graphviz dot
	  executable through PATH but invokes the resulting absolute
	  executable without routing through spawn_trusted, so
	  resolve_trusted_executable ownership and writability validation and
	  safe_env loader environment scrubbing do not run. A local low-
	  privileged attacker who can write to a directory on a POSIX
	  victim's PATH can plant or replace dot, and code executes as the
	  victim when dot2img is called directly or DependencyGraph.repr_svg
	  renders a graph. The current-working-directory-only bare-name
	  vector is blocked and is not this vulnerability; this issue is the
	  residual writable absolute PATH element bypass after
	  CVE-2026-78680. This issue is fixed in version 3.10.4.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-128134</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-128134</url>
    </references>
    <dates>
      <discovery>2026-11-13</discovery>
      <entry>2026-11-15</entry>
    </dates>
  </vuln>