Skip to content

RHAIENG-4014: constrain nltk to 3.9.4 for rhoai-2.25 #2050

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jiridanek merged 2 commits into from
Apr 2, 2026
Merged

RHAIENG-4014: constrain nltk to 3.9.4 for rhoai-2.25 #2050

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
68c2852
RHAIENG-4014: constrain nltk to 3.9.4 for rhoai-2.25
jiridanek Mar 26, 2026
e65b74b
RHAIENG-4014: revert unintended tooling changes
jiridanek Mar 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions dependencies/cve-constraints.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# CVE-induced minimum version constraints
# This file is used with `uv pip compile --constraints`
#
# Format: requirements.txt style (package>=version)
#
# When adding a new CVE fix:
# 1. Add the constraint below with CVE ID and issue reference in a comment
# 2. Regenerate the affected lock files

# RHAIENG-4014: CVE-2026-33236 NLTK path traversal in XML index files
# Reference: https://access.redhat.com/security/cve/CVE-2026-33236
nltk>=3.9.4
Comment on lines +10 to +12
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

Does CVE-2026-33236 exist and what is the minimum NLTK version that fixes it?

💡 Result:

Yes, CVE-2026-33236 exists. It is a path traversal vulnerability in the NLTK downloader that affects versions 3.9.3 and prior. The issue is fixed in commit 89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a from March 18, 2026. NLTK 3.9.4, released on March 24, 2026, includes this fix along with several security enhancements.

Citations:

🌐 Web query:

Is the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-33236 valid and accessible?

💡 Result:

No, the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-33236 is not valid in the sense of providing specific security details or affected products for CVE-2026-33236. The page exists and is accessible publicly, but it displays only generic Red Hat Customer Portal content (e.g., login prompts, links to subscriptions, support) without any CVE-specific information such as description, severity, affected products, or patches. This indicates Red Hat has not yet published a full advisory for this CVE. CVE-2026-33236 is a real vulnerability in NLTK (Natural Language Toolkit) involving path traversal in the downloader via remote XML index files, allowing arbitrary file creation/overwrite (CVSS 8.1 High, published 2026-03-20). Red Hat has tracked it in Bugzilla (BZ 2449824, status NEW, high priority, Security Response product), confirming awareness, but no RHSA or affected products are listed in public sources. It does not appear in recent RHSAs (e.g., RHSA-2026:3360, RHSA-2026:2664) or the Red Hat Security API CVE list.

Citations:

Update advisory reference for accuracy.

CVE-2026-33236 is confirmed as a real path traversal vulnerability in NLTK affecting versions 3.9.3 and prior, with NLTK 3.9.4 (released March 24, 2026) containing the fix. However, the Red Hat advisory link does not currently contain detailed CVE information—Red Hat is tracking the vulnerability but has not yet published a public RHSA. Update the reference to point to the publicly available advisories instead:

Updated comment (recommended) 
# CVE-2026-33236: NLTK path traversal in XML index files
# Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33236
# GitHub advisory: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
nltk>=3.9.4
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@dependencies/cve-constraints.txt` around lines 10 - 12, Replace the current
Red Hat advisory comment for CVE-2026-33236 with public advisories: update the
top comment block that references CVE-2026-33236 (above the dependency line
"nltk>=3.9.4") to use the NVD and GitHub advisory links instead (e.g.,
"Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33236" and "GitHub
advisory: https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7")
and adjust the wording to note that nltk>=3.9.4 contains the fix.

Loading
Loading