NLTK Advisory: Per-Call `java_options` Bypass Reopens JVM Argument Injection Closed by CVE-2026-12841 (CVE-2026-79675)

A new GitHub Security Advisory (GHSA-m4rf-3fr8-xwx3, CVE-2026-79675, CVSS 9.8) reports that the fix for a prior NLTK vulnerability, CVE-2026-12841, is incomplete. According to the advisory, NLTK added a _validate_java_options() check to block dangerous JVM flags (-agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references), but that validation only runs on the global config_java() path. The java() function's per-call options parameter — added separately for a different CVE fix (CVE-2026-12615) — passes options straight to subprocess.Popen with no validation, and all four Stanford Java wrapper classes (GenericStanfordParser, StanfordTagger, StanfordTokenizer, StanfordSegmenter) route their user-supplied java_options through this unvalidated path.

Why It Matters

The report states this affects the nltk package on PyPI. Any application that instantiates one of the four Stanford wrapper classes and derives java_options from user input, configuration, or environment variables is exposed to arbitrary JVM flag injection — including flags like -agentpath or -javaagent that load native or Java agents, which the advisory characterizes as leading to arbitrary code execution. A public proof-of-concept accompanies the advisory (exploit status: poc-public), and no CVE-specific patch details beyond the reporter's suggested one-line fix are given in the item.

What Defenders Should Watch For

• Inventory services that use NLTK's Stanford wrapper classes (parser, tagger, tokenizer, segmenter) and check whether any code path lets external input reach the java_options / options constructor arguments.
• Until an upstream fix lands, treat any application-controlled construction of these JVM option strings as untrusted input and validate/allowlist them at the application layer rather than relying on NLTK's internal check.
• At a hunting level, look for JVM child processes spawned by Python/NLTK hosts with unexpected flags such as -agentpath, -javaagent, -agentlib, -Xrunjdwp, or @-prefixed argfile arguments in process command-line telemetry.
• Monitor for unexpected outbound JDWP debug listeners (a common pattern with -agentlib:jdwp=...,server=y,address=*:PORT) on hosts running NLTK-based services.

This is fresh, developing intel based on a single security advisory published same-day; no confirmed in-the-wild exploitation or vendor patch timeline is included in the source material reviewed. Track the advisory directly for updates and an eventual fix: GHSA-m4rf-3fr8-xwx3.